QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2020-15270

Back to search

CVE-2020-15270

Published: Oct 22, 2020

Modified: Aug 4, 2024

PUBLISHED

CVSS v3.1

4.3

MEDIUM

Description

Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.

VendorProductVersions

parse-community

parse-server

affected
<= 4.3.0

Weaknesses (CWE)

CWE-672

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now