Description
In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| parse-community | parse-server | < 4.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | parse-server | < 4.1.0 | 4.1.0 | GHSA-h4mf-75hf-67w4 |