CVE-2022-41879

Опубликовано: 10 нояб. 2022

Источник: nvd

CVSS3: 7.2

CVSS3: 9.8

EPSS Низкий

Описание

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server requestKeywordDenylist option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.

Ссылки

https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf
Third Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*

Версия до 4.10.20 (исключая)

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*

Версия от 5.0.0 (включая) до 5.3.3 (исключая)

EPSS

Процентиль: 63%

0.00438

Низкий

7.2 High

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-1321

Связанные уязвимости

GHSA-93vw-8fm5-p2jf

CVSS3: 7.2

github

около 3 лет назад

Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks

EPSS

Процентиль: 63%

0.00438

Низкий

7.2 High

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-1321