CVE-2022-31112

🗓️ 30 Jun 2022 16:40:13Reported by MendType

mend🔗 www.mend.io

Parse Server LiveQuery does not remove protected fields from classes, exposing them to clients.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2022-31112	30 Jun 202220:38	–	circl
CNNVD	Parse Server 信息泄露漏洞	30 Jun 202200:00	–	cnnvd
CVE	CVE-2022-31112	30 Jun 202216:40	–	cve
Cvelist	CVE-2022-31112 Protected fields exposed via LiveQuery in parse-server	30 Jun 202216:40	–	cvelist
EUVD	EUVD-2022-6325	3 Oct 202520:07	–	euvd
Github Security Blog	Protected fields exposed via LiveQuery	6 Jul 202219:52	–	github
NVD	CVE-2022-31112	30 Jun 202217:15	–	nvd
OSV	BIT-PARSE-2022-31112 Protected fields exposed via LiveQuery in parse-server	6 Mar 202411:02	–	osv
OSV	GHSA-CRRQ-VR9J-FXXH Protected fields exposed via LiveQuery	6 Jul 202219:52	–	osv
Prion	Design/Logic Flaw	30 Jun 202217:15	–	prion

Vulners

Node

OR

parseplatform parse-serverRange1.0.0–4.10.13

parseplatform parse-serverRange5.0.0–5.2.4

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
github	www.github.com/parse-community/parse-server/issues/8073
github	www.github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-31112
github	www.github.com/parse-community/parse-server
github	www.github.com/parse-community/parse-server/releases/tag/5.2.4
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31112.json
github	www.github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6
github	www.github.com/parse-community/parse-server/commit/054f3e6ab01d66a0dcfb77725af28eac1485b375
github	www.github.com/parse-community/parse-server/pull/8074

06 Oct 2026 02:41Current

CVSS 3.18.2

CVSS 48.8

CVSS 26.4

EPSS0.01304

SSVC

CWE-212 CWE-200

Parse Server LiveQuery information disclosure protected fields