CVE-2021-41109

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.4, for regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload. A patch in version 4.10.4 removes session tokens from the LiveQuery payload. As a workaround, set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41114.3yetiforcecrm is vulnerable to Business Logic Errors CVE-2021-411109.8cwlviewer is a web application to view and share Common Workflow Language workflows. Versions prior to 1.3.1 contain a Deserialization of Un CVE-2021-411115.4Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an aut CVE-2021-411128.1Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated CVE-2021-411138.8TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 fe CVE-2021-411145.3TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is suscept CVE-2021-411156.5Zulip is an open source team chat server. In affected versions Zulip allows organization administrators on a server to configure "linkifiers CVE-2021-411169.8Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted CVE-2021-411179.1keypair is a a RSA PEM key generator written in javascript. keypair implements a lot of cryptographic primitives on its own or by borrowing CVE-2021-411187.5The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and detail CVE-2021-411197.5Wire-server is the system server for the wire back-end services. Releases prior to v2022-03-01 are subject to a denial of service attack via CVE-2021-41128.8A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an attacker to elev