Observable discrepancy in parse-server - CVE-2019-1020013

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information about linked accounts and email addresses.

The vulnerability exists due to improper access control in the account linking functionality when handling account linking requests. A remote attacker can guess account identifiers and observe different error responses to disclose sensitive information about linked accounts and email addresses.

The issue arises because different errors are returned before insufficient authorization is checked.

Affected software

How to mitigate CVE-2019-1020013

External References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8w3j-g983-8jh5
• https://github.com/parse-community/parse-server/commit/73b0f9a339b81f5d757725dc557955a7b670a3ec

Related Security Bulletins

• Observable discrepancy in parse-server