Medium severity · published Oct 22, 2020
CVE-2020-15270
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid
4.3
CVSS
1.2%
EPSS
No
On KEV
Description
Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with invalid session tokens. The issue is not patched.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
Parse-server · Parseplatform
through 4.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15270
Patch
https://github.com/parse-community/parse-server/commit/78b59fb26b1c36e3cdbd42ba9fec025003267f58
Third Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-2xm2-xj2q-qgpj
Product
https://npmjs.com/parse-server
More from Parse-server
10.0
CVE-2026-30966
Parse Server role escalation and CLP bypass via direct `_Join` table write
10.0
CVE-2024-27298
Parse Server literalizeRegexPart SQL Injection
10.0
CVE-2022-24760
Command Injection in Parse server
9.8
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
9.8
CVE-2026-31871
Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL