CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2020-15270
Medium (4.3) in parseplatform parse-server. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in parse-server 4.4.0.
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-672
- Published
- Modified
- Record from
- the NVD, synced
Affected
- parseplatform:parse-server
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2xm2-xj2q-qgpj | npm | parse-server | <4.4.0 | 4.4.0 |
References
- https://github.com/parse-community/parse-server/commit/78b59fb26b1c36e3cdbd42ba9fec025003267f58
- https://github.com/parse-community/parse-server/security/advisories/GHSA-2xm2-xj2q-qgpj
- https://npmjs.com/parse-server
- https://github.com/parse-community/parse-server/commit/78b59fb26b1c36e3cdbd42ba9fec025003267f58
- https://github.com/parse-community/parse-server/security/advisories/GHSA-2xm2-xj2q-qgpj