CVE-2021-41109

Katalog CVE

CVSS 7.5 · High EPSS 1,2%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada parseplatform parse-server. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.

Rincian

Terbit di NVD

30 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 68,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559 patch · advisory pihak ketiga
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9x mitigasi · advisory pihak ketiga
• https://github.com/parse-community/parse-server/releases/tag/4.10.4 release notes · advisory pihak ketiga