// For flags

CVE-2021-41109

LiveQuery publishes user session tokens

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.

Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Anterior a versión 4.10.4, para las consultas normales (no LiveQuery), el token de sesión se eliminaba de la respuesta, pero para las cargas útiles de LiveQuery actualmente no. Si un usuario presenta una suscripción a LiveQuery en la clase "Parse.User", todos los tokens de sesión creados durante el registro del usuario serán emitidos como parte de la carga útil de LiveQuery. Un parche en la versión 4.10.4 elimina los tokens de sesión de la carga útil de LiveQuery. Como solución, establezca "user.acl(new Parse.ACL())" en un desencadenador beforeSave para que el usuario sea privado ya en el momento del registro

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-15 CVE Reserved
  • 2021-09-30 CVE Published
  • 2024-06-15 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Parseplatform
Search vendor "Parseplatform"
 Parse-server
Search vendor "Parseplatform" for product "Parse-server"
 < 4.10.4
Search vendor "Parseplatform" for product "Parse-server" and version " < 4.10.4"
node.js
Affected