Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Remediation
References
https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
Related Vulnerabilities
CVE-2020-9447 Vulnerability in maven package com.googlecode.gwtupload:gwtupload-samples
CVE-2019-11002 Vulnerability in npm package materialize-css
CVE-2022-36034 Vulnerability in npm package nitrado.js
CVE-2018-19586 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web
CVE-2023-30527 Vulnerability in maven package org.jenkins-ci.plugins:wso2id-oauth