Command Injection in Parse server
60Vexday Risk Score
Haz seguimiento. Ella tiene prueba de concepto pública.
ssvc Attendcvss 10epss 49%
de la publicación al arma20 días
Publicada en NVD11 mar
1ª PoC+20d
probabilidad de explotación
49%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Productos afectados
parse-community · parse-serverPoCs públicas encontradas — 1
githubgithub.com/tuo4n8/CVE-2022-24760★ 1⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.