Description
In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.
Remediation
References
https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430
https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa
https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73
Related Vulnerabilities
CVE-2020-2131 Vulnerability in maven package org.jenkins-ci.plugins:harvest
CVE-2022-2900 Vulnerability in npm package parse-url
CVE-2019-10416 Vulnerability in maven package org.jenkins-ci.plugins:violation-comments-to-gitlab
CVE-2020-16040 Vulnerability in maven package org.webjars.npm:electron
CVE-2020-7758 Vulnerability in npm package browserless-chrome