CVE-2023-36475
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
28/06/2023
Last modified:
06/07/2023
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
Impact
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* | 5.5.2 (excluding) | |
| cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* | 6.0.0 (including) | 6.2.1 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90
- https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f
- https://github.com/parse-community/parse-server/issues/8674
- https://github.com/parse-community/parse-server/issues/8675
- https://github.com/parse-community/parse-server/releases/tag/5.5.2
- https://github.com/parse-community/parse-server/releases/tag/6.2.1
- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6