CVE-2022-24760: fallo crítico en parse-community parse-server
Command Injection in Parse server
Publicada el · Actualizada el
60Vexday Risk Score
Haz seguimiento. Ella tiene prueba de concepto pública.
ssvc Attendcvss 10epss 49%
de la publicación al arma20 días
Publicada en NVD11 mar
1ª PoC+20d
probabilidad de explotación
49%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
parse-community · parse-serverPoCs públicas encontradas — 1
githubgithub.com/tuo4n8/CVE-2022-24760★ 1⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — parse-community parse-server
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-39396CRITICALParse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parserEPSS 38.7%CVE-2024-39309CRITICALZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass VulnerabilityEPSS 20.2%CVE-2023-36475CRITICALParse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollutionEPSS 3.2%CVE-2021-39187HIGHCrash server with query parameterEPSS 1.8%CVE-2026-30965CRITICALParse Server session token exfiltration via `redirectClassNameForKey` query parameterEPSS 1.6%CVE-2022-31112HIGHProtected fields exposed via LiveQuery in parse-serverEPSS 1.3%