crítica
CVE-2022-41879
Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según GHSA (alta).
Descripción
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | parse | 4.10.20, 5.3.3 |
| npm::GitHub Security Advisory npm | parse-server | 4.10.20, 5.3.3 |
Referencias
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/commit/60c5a73d257e0d536056b38bdafef8b7130524d8
- https://github.com/parse-community/parse-server/commit/6c63f04ba37174021082a5b5c4ba1556dcc954f4
- https://github.com/parse-community/parse-server/pull/8305
- https://github.com/parse-community/parse-server/pull/8306
- https://github.com/parse-community/parse-server/releases/tag/4.10.20
- https://github.com/parse-community/parse-server/releases/tag/5.3.3
- https://github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf