Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Remediation
References
https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
Related Vulnerabilities
CVE-2020-11022 Vulnerability in maven package org.webjars.bowergithub.jquery:jquery
CVE-2023-40167 Vulnerability in maven package org.eclipse.jetty:jetty-http
CVE-2019-1003041 Vulnerability in maven package org.jenkins-ci.plugins:groovy
CVE-2020-1945 Vulnerability in maven package org.apache.ant:ant