CVE-2020-15270CWE-672

Improper session expiration in Parse Server

Medium · published October 22, 2020

CVSS v3.1
4.3
EPSS
1%
Percentile
67.1
In the wild
Unconfirmed
What it is

Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01165 · 67.1th percentile
Weakness
CWE-672 · Operation on a Resource after Expiration or Release
Published
2020-10-22T21:25Z
EPSS history
Timeline
  • 22 OCT 21:25Z
    Improper session expiration in Parse Server
    cvelistv5