CVE-2020-15126 Information disclosure through Viewer query in parse-server
Authenticated users can bypass read security restrictions on their own User object and linked objects via GraphQL queries.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15126?
CVE-2020-15126 is a medium-severity missing authorization vulnerability in parse-community parse-server, published on 22 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Weakness: CWE-863
Which versions are affected by CVE-2020-15126?
2 open source packages ship an affected version, including parse-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
parse-server npm | From 3.5.0 | 4.3.0 |
parse-server npm | From 3.5.0 | 4.3.0 |
Products include Parseplatform Parse Server.
How do I fix CVE-2020-15126?
Upgrade parse-server to 4.3.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-15126 being exploited?
There is no known exploitation of CVE-2020-15126 in the wild and no public exploit code.
Sources
Also known as GHSA-236h-rqv8-8q73.