Security readout for executives and security teams
Plain-English summary
Parse Server before 4.10.4 could accidentally send newly created user session tokens through LiveQuery updates when someone subscribed to Parse.User. Those tokens are sensitive because they represent authenticated sessions. This is a high-priority confidentiality issue for deployments using LiveQuery on user data, especially internet-facing apps with public sign-up.
Executive priority
Treat this as a high-priority remediation for any Parse Server application using LiveQuery with user objects. The business concern is unauthorized exposure of live user session tokens. Prioritize upgrade or the documented workaround before routine maintenance windows for exposed production systems.
Technical view
Regular Parse queries stripped sessionToken from responses, but LiveQuery payloads did not. With a LiveQuery subscription on the Parse.User class, session tokens created during user sign-up could be included in broadcast payloads. Version 4.10.4 removes session tokens from LiveQuery payloads; the advisory also names a beforeSave ACL workaround.
Likely exposure
Exposure is likely limited to parse-community parse-server versions before 4.10.4 where LiveQuery is enabled and clients can subscribe to Parse.User. The source bundle does not prove exposure for deployments that do not use LiveQuery or do not expose user subscriptions.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and the cited sources do not claim active exploitation. The issue is serious because token disclosure can occur through application data flow, but the sources do not provide evidence of public exploitation or weaponization.
Researcher notes
The core condition is Parse.User LiveQuery subscription behavior before 4.10.4. Evidence supports confidentiality impact only; CVSS lists no integrity or availability impact. Validate configuration and observable payload behavior without disclosing real tokens. If implementation details differ locally, defer to the vendor advisory and patch commit.
Mitigation direction
- Upgrade parse-server to version 4.10.4 or later.
- Apply the vendor workaround if immediate upgrade is blocked.
- Set user ACLs private in a beforeSave trigger during sign-up.
- Review vendor release notes and advisory before deployment.
Validation and detection
- Inventory parse-server versions and identify any below 4.10.4.
- Confirm whether LiveQuery is enabled in affected deployments.
- Review whether clients can subscribe to the Parse.User class.
- Check application logs for unexpected user LiveQuery subscriptions.
- Verify updated deployments no longer include sessionToken in LiveQuery user payloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-41109 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/parse-community/parse-server/security/advisories/GHSA-7pr3-p5fm-8r9xCVE reference · x_refsource_CONFIRM
- https://github.com/parse-community/parse-server/commit/4ac4b7f71002ed4fbedbb901db1f6ed1e9ac5559CVE reference · x_refsource_MISC
- https://github.com/parse-community/parse-server/releases/tag/4.10.4CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.