Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Remediation
References
https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
Related Vulnerabilities
CVE-2020-6452 Vulnerability in maven package org.webjars.npm:electron
CVE-2022-29172 Vulnerability in npm package auth0-lock
CVE-2020-15232 Vulnerability in maven package org.mapfish.print:print-standalone
CVE-2020-7634 Vulnerability in npm package heroku-addonpool
CVE-2020-28472 Vulnerability in npm package @aws-sdk/shared-ini-file-loader