CVE-2020-15126

Katalog CVE

CVSS 6.5 · Medium EPSS 1,1%

Kerentanan Incorrect Authorization pada parseplatform parse server. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

Rincian

Terbit di NVD

22 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa patch · advisory pihak ketiga
• https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430 release notes · advisory pihak ketiga
• https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 advisory pihak ketiga