Information disclosure in Parse-Community Parse-Server
CVE-2022-36079
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.013 (68.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 68th percentile — 68.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.013 · change: +0.002
Affected products
- Parse-Community Parse-Server — versions < 4.10.14, >= 5.0.0, < 5.2.5
- Parseplatform Parse-Server
Weakness classification (CWE)
References
- github.com/parse-community/parse-server/security/advisories/GHSA-2m6g-crv8-p3c6 (Third Party Advisory)
- github.com/parse-community/parse-server/issues/8143 (Third Party Advisory, Issue Tracking)
- github.com/parse-community/parse-server/issues/8144 (Third Party Advisory, Issue Tracking)
- github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89a2b602d… (Patch, Third Party Advisory)
- github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd659db46e… (Patch, Third Party Advisory)
- github.com/parse-community/parse-server/releases/tag/4.10.14 (Third Party Advisory, Release Notes)
- github.com/parse-community/parse-server/releases/tag/5.2.5 (Third Party Advisory, Release Notes)
Frequently asked questions
- What is CVE-2022-36079?
- CVE-2022-36079 is a high-severity vulnerability in Parse-Community Parse-Server, classified under Information Disclosure. CVSS score: 8.6/10. Published 2022-09-07.
- How severe is CVE-2022-36079?
- High severity. CVSS v3 base score is 8.6 out of 10.