Lucene search

PRIOn knowledge basePRION:CVE-2024-27298

HistoryMar 01, 2024 - 6:15 p.m.

Sql injection

2024-03-0118:15:00

PRIOn knowledge base

www.prio-n.com

parse server

sql injection

postgresql

vulnerability

fixed

8.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.7%

JSON

parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

References

github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504

github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833

github.com/parse-community/parse-server/releases/tag/6.5.0

github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20

github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2