Command Injection in Parse server
60Vexday Risk Score
Acompanhe. Ela tem prova de conceito pública.
ssvc Attendcvss 10epss 49%
da publicação à arma20 dias
Publicada no NVD11 de mar.
1ª PoC+20d
probabilidade de exploração
49%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
parse-community · parse-serverPoCs públicas encontradas — 1
githubgithub.com/tuo4n8/CVE-2022-24760★ 1⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.