PT-2026-107987 · Unknown · Parse Server
CVSS v4.0
6.3
متوسطة
| المتجه | AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Parse Server versions 8.2.2 through 8.6.91
Parse Server versions 9.0.0 through 9.10.1-alpha.11
Description
An information disclosure issue exists where GraphQL validation error messages reveal hidden class names even when public introspection is disabled. Unauthenticated attackers with the public Application Id can send crafted operations to trigger unknown-argument or invalid enum value errors, allowing them to discover pointer and relation target classes.
Recommendations
Update Parse Server to version 8.6.92 or later.
Update Parse Server to version 9.10.1-alpha.12 or later.
استغلال
إصلاح
Generation of Error Message Containing Sensitive Information
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Parse Server