Vulnerability · Published Oct 25, 2023 · Assigned by GitHub_M
CVE-2023-46119Parse Server may crash when uploading file without extension
High 7.5
In plain English
A high-severity security flaw in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.3%top 29.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | parse-server | 5.5.6 | GHSA-792q-q67h-w579 |
| npm | parse-server | 6.3.1 | GHSA-792q-q67h-w579 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| parse-community | parse-server | >= 1.0.0, < 5.5.6>= 6.0.0, < 6.3.1 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579 x_refsource_CONFIRM
- https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe x_refsource_MISC
- https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0 x_refsource_MISC
- https://github.com/parse-community/parse-server/releases/tag/5.5.6 x_refsource_MISC
- https://github.com/parse-community/parse-server/releases/tag/6.3.1 x_refsource_MISC