CVE-2020-5251: Information disclosure in parse-server
In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
parser-serverto a version that resolves this vulnerability.Fixed in 4.1.0 - Compensating control
Prevent information disclosure by avoiding NoSQL regex queries on sessionToken in parser-server/parse-server requests (do not allow user-controlled regex against sessionToken).
Event History
Frequently Asked Questions
What is CVE-2020-5251?
CVE-2020-5251 is a vulnerability in parser-server before version 4.1.0 that allows an attacker to fetch all user objects using a regex in the NoSQL query.
How can an attacker exploit CVE-2020-5251?
An attacker can exploit CVE-2020-5251 by using a regex on the sessionToken to find valid accounts.
What is the severity of CVE-2020-5251?
CVE-2020-5251 has a severity rating of 5.3 (High).
What software versions are affected by CVE-2020-5251?
Versions of parse-server up to and excluding 4.1.0 are affected by CVE-2020-5251.
How do I fix CVE-2020-5251?
To fix CVE-2020-5251, upgrade to version 4.1.0 or later of parse-server.