Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks

🗓️ 10 Nov 2022 13:02:35Reported by GitHub Advisory DatabaseType

Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks. Impact on `requestKeywordDenylist`. Patches include improved keyword detection

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2022-41879	13 Nov 202205:39	–	circl
CNNVD	Parse Server 安全漏洞	10 Nov 202200:00	–	cnnvd
CVE	CVE-2022-41879	10 Nov 202200:00	–	cve
Cvelist	CVE-2022-41879 Parse Server subject to Prototype pollution via Cloud Code Webhooks	10 Nov 202200:00	–	cvelist
EUVD	EUVD-2022-7291	3 Oct 202520:07	–	euvd
NVD	CVE-2022-41879	10 Nov 202221:15	–	nvd
OSV	BIT-PARSE-2022-41879 Parse Server subject to Prototype pollution via Cloud Code Webhooks	6 Mar 202411:01	–	osv
OSV	GHSA-93VW-8FM5-P2JF Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks	10 Nov 202213:02	–	osv
Prion	Design/Logic Flaw	10 Nov 202221:15	–	prion
Positive Technologies	PT-2022-26111 · Unknown · Parse Server	10 Nov 202200:00	–	ptsecurity

Vulners

Node

parseplatform parse-serverRange5.0.0–5.3.3npm

parseplatform parse-serverRange<4.10.20npm

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-93vw-8fm5-p2jf
github	www.github.com/parse-community/parse-server/pull/8305
github	www.github.com/parse-community/parse-server/pull/8306
github	www.github.com/parse-community/parse-server/commit/60c5a73d257e0d536056b38bdafef8b7130524d8
github	www.github.com/parse-community/parse-server/commit/6c63f04ba37174021082a5b5c4ba1556dcc954f4
github	www.github.com/parse-community/parse-server/releases/tag/4.10.20
github	www.github.com/parse-community/parse-server/releases/tag/5.3.3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-41879
github	www.github.com/advisories/GHSA-93vw-8fm5-p2jf

21 Aug 2023 18:17Current

9High risk

Vulners AI Score9

CVSS 3.17.2 - 9.8

EPSS0.00809

SSVC

CWE-1321