kritisch
CVE-2022-41879
Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, Bitnami. Niedriger laut GHSA (hoch).
Beschreibung
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | parse | 4.10.20, 5.3.3 |
| npm::GitHub Security Advisory npm | parse-server | 4.10.20, 5.3.3 |
Referenzen
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/commit/60c5a73d257e0d536056b38bdafef8b7130524d8
- https://github.com/parse-community/parse-server/commit/6c63f04ba37174021082a5b5c4ba1556dcc954f4
- https://github.com/parse-community/parse-server/pull/8305
- https://github.com/parse-community/parse-server/pull/8306
- https://github.com/parse-community/parse-server/releases/tag/4.10.20
- https://github.com/parse-community/parse-server/releases/tag/5.3.3
- https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf