CVE-2020-15270: Improper session expiration in Parse Server
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-15270?
CVE-2020-15270 is a vulnerability in Parse Server that allows clients with expired sessions to still receive subscription objects.
How severe is CVE-2020-15270?
CVE-2020-15270 is classified as medium severity with a CVSS score of 4.3.
Which software is affected by CVE-2020-15270?
Parse Server versions up to 4.3.0 are affected by CVE-2020-15270.
How can I fix CVE-2020-15270?
To fix CVE-2020-15270, update Parse Server to a version above 4.3.0.
Where can I find more information about CVE-2020-15270?
You can find more information about CVE-2020-15270 on the GitHub repository and npmjs.com page for parse-server.