Vulnerability Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Parseplatform | Parse-Server | < 5.5.2 |
Related Weaknesses (CWE)
References
- https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844Patch
- https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf2Patch
- https://github.com/parse-community/parse-server/issues/8674Issue TrackingPatch
- https://github.com/parse-community/parse-server/issues/8675Issue TrackingPatch
- https://github.com/parse-community/parse-server/releases/tag/5.5.2Release Notes
- https://github.com/parse-community/parse-server/releases/tag/6.2.1Release Notes
- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3Vendor Advisory
- https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844Patch
- https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf2Patch
- https://github.com/parse-community/parse-server/issues/8674Issue TrackingPatch
- https://github.com/parse-community/parse-server/issues/8675Issue TrackingPatch
- https://github.com/parse-community/parse-server/releases/tag/5.5.2Release Notes
- https://github.com/parse-community/parse-server/releases/tag/6.2.1Release Notes
- https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3Vendor Advisory
FAQ
What is CVE-2023-36475?
CVE-2023-36475 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a r...
How severe is CVE-2023-36475?
CVE-2023-36475 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-36475?
Check the references section above for vendor advisories and patch information. Affected products include: Parseplatform Parse-Server.