Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via the protectedFields server option. Any authenticated user can retrieve their own session's protected fields with a single request. The equivalent GET /sessions and GET /sessions/:objectId endpoints correctly strip protected fields. This vulnerability is fixed in 9.8.0-alpha.7 and 8.6.75.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| parse-community | parse-server | >= 9.0.0, < 9.8.0-alpha.7, >= 7.0.0, < 8.6.75 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | parse-server | >= 9.0.0, < 9.8.0-alpha.7 | 9.8.0-alpha.7 | GHSA-g4v2-qx3q-4p64 |
| npm | parse-server | >= 7.0.0, < 8.6.75 | 8.6.75 | GHSA-g4v2-qx3q-4p64 |