CVE-2024-27298

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-27298
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
https://github.com/parse-community/parse-server/releases/tag/6.5.0
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504
https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833
https://github.com/parse-community/parse-server/releases/tag/6.5.0
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20
https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2
Configurations

No configuration.

History

21 Nov 2024, 09:04

Type Values Removed Values Added
References () https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504 - () https://github.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504 -
References () https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833 - () https://github.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833 -
References () https://github.com/parse-community/parse-server/releases/tag/6.5.0 - () https://github.com/parse-community/parse-server/releases/tag/6.5.0 -
References () https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 - () https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20 -
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 - () https://github.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2 -
Summary
  • (es) parse-server es un servidor Parse para Node.js/Express. Esta vulnerabilidad permite la inyección de SQL cuando Parse Server está configurado para utilizar la base de datos PostgreSQL. La vulnerabilidad se solucionó en 6.5.0 y 7.0.0-alpha.20.

01 Mar 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-01 18:15

Updated : 2024-11-21 09:04

NVD link : CVE-2024-27298

Mitre link : CVE-2024-27298

CVE.ORG link : CVE-2024-27298

JSON object : View

Products Affected

No product.

CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')