CVE-2020-5251

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-285 CWE-863

Affected software

Vendor	Product	Versions
parse-community	parse-server	< 4.1.0

References

https://github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da1352423312cb767de14de269Patch, Third Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-h4mf-75hf-67w4Third Party Advisory
https://github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da1352423312cb767de14de269Patch, Third Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-h4mf-75hf-67w4Third Party Advisory

Timeline

Published: Mar 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52524.1The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code CVE-2020-52539.8NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be e CVE-2020-52548.1In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue.CVE-2020-52554.3In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fal CVE-2020-52568.8BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow th CVE-2020-52578.1In Administrate (rubygem) before version 0.13.0, when sorting by attributes on a dashboard, the direction parameter was not validated before CVE-2020-52587.7In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abil CVE-2020-52598.6In affected versions of dojox (NPM package), the jqMix method is vulnerable to Prototype Pollution. Prototype Pollution refers to the abilit CVE-2020-52607.5Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacke CVE-2020-52616.8Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty impl CVE-2020-52625.5In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new CVE-2020-52634.9auth0.js (NPM package auth0-js) greater than version 8.0.0 and before version 9.12.3 has a vulnerability. In the case of an (authentication)