GHSA-236h-rqv8-8q73
GraphQL: Security breach on Viewer query
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | parse-server | >= 3.5.0, < 4.3.0 | 4.3.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.
### Patches
This vulnerability has been patched in Parse Server 4.3.0.
### Workarounds
No
### References
See [commit 78239ac](https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa) for details.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
- https://nvd.nist.gov/vuln/detail/CVE-2020-15126
- https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
- https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430