Vulnerability Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Parseplatform | Parse-Server | < 4.10.13 |
Related Weaknesses (CWE)
References
- https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cPatchThird Party Advisory
- https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd054PatchThird Party Advisory
- https://github.com/parse-community/parse-server/issues/8073Issue TrackingPatchRelease Notes
- https://github.com/parse-community/parse-server/pull/8074PatchRelease NotesThird Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/5.2.4Release NotesThird Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vrThird Party Advisory
- https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cPatchThird Party Advisory
- https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd054PatchThird Party Advisory
- https://github.com/parse-community/parse-server/issues/8073Issue TrackingPatchRelease Notes
- https://github.com/parse-community/parse-server/pull/8074PatchRelease NotesThird Party Advisory
- https://github.com/parse-community/parse-server/releases/tag/5.2.4Release NotesThird Party Advisory
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vrThird Party Advisory
FAQ
What is CVE-2022-31112?
CVE-2022-31112 is a vulnerability with a CVSS score of 8.2 (HIGH). Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing...
How severe is CVE-2022-31112?
CVE-2022-31112 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31112?
Check the references section above for vendor advisories and patch information. Affected products include: Parseplatform Parse-Server.