PT-2020-14206 · Parse · Parse Server

Moumouls · Published 2020-02-05 · Updated 2020-07-28 · CVE-2020-15126

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions parser-server versions 3.5.0 through 4.2.x

Description The issue allows an authenticated user using the viewer GraphQL query to bypass all read security on their User object and on objects linked via relation or Pointer on their User object. This vulnerability has been patched in Parse Server 4.3.0.

Recommendations For parser-server versions 3.5.0 through 4.2.x, update to version 4.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the viewer GraphQL query until the patch is applied.

Fix

Incorrect Authorization

Time Of Check To Time Of Use

Weakness Enumeration

CWE-863

CWE-367

Related Identifiers

BDU:2020-01161

CVE-2020-15126

GHSA-236H-RQV8-8Q73

Affected Products

Parse Server

References · 8

• https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa · Patch
• https://osv.dev/vulnerability/GHSA-236h-rqv8-8q73 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01161 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15126 · Security Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 · Note
• https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430 · Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200226-wi-fi-info-disclosure · Note