CVE-2025-68150

Опубликовано: 16 дек. 2025

Источник: nvd

CVSS3: 6.5

EPSS Низкий

Описание

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1-alpha.1, the Instagram authentication adapter allows clients to specify a custom API URL via the apiURL parameter in authData. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. This is fixed in versions 8.6.2 and 9.1.1-alpha.1 by hardcoding the Instagram Graph API URL https://graph.instagram.com and ignoring client-provided apiURL values. No known workarounds are available.

Ссылки

https://github.com/parse-community/parse-server/pull/9988
Issue Tracking
Patch
https://github.com/parse-community/parse-server/pull/9989
Issue Tracking
Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-3f5f-xgrj-97pf
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*

Версия до 8.6.2 (исключая)

cpe:2.3:a:parseplatform:parse-server:9.0.0:-:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha1:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha10:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha11:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha2:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha3:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha4:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha5:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha6:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha7:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha8:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.0.0:alpha9:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.1.0:-:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.1.0:alpha1:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.1.0:alpha2:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.1.0:alpha3:*:*:*:node.js:*:*

cpe:2.3:a:parseplatform:parse-server:9.1.0:alpha4:*:*:*:node.js:*:*

EPSS

Процентиль: 24%

0.00083

Низкий

6.5 Medium

CVSS3

Дефекты

CWE-918

Связанные уязвимости

GHSA-3f5f-xgrj-97pf

github

около 2 месяцев назад

Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter