Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.4epss 0.4%
probabilidade de exploração
0.4%top 65% das CVEs
exploração observada
nãonenhuma fonte reporta
Parse Javascript SDK provides access to the powerful Parse Server backend from your JavaScript app. Prior to 7.0.0, injection of malicious payload allows attacker to remotely execute arbitrary code. ParseObject.fromJSON, ParseObject.pin, ParseObject.registerSubclass, ObjectStateMutations (internal), and encode/decode (internal) are affected. This vulnerability is fixed in 7.0.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Produtos afetados
parse-community · Parse-SDK-JSReferências
https://github.com/parse-community/Parse-SDK-JS/commit/00973987f361368659c0c4dbf669f3897520b132https://github.com/parse-community/Parse-SDK-JS/pull/2749https://github.com/parse-community/Parse-SDK-JS/releases/tag/7.0.0-alpha.1https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-9f2h-7v79-mxw3