p PatchFirst

CVE-2022-36079

CVE-2022-36079 · Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.

CVSS 8.6 · Élevée · EPSS 1,3% · Correctif disponible

Publication
Mise à jour

Pile logicielle: node

Produits et versions concernés

  • parse-server

    Versions du logiciel
    • < 4.10.14: Concernée
    • >= 5.0.0, < 5.2.5: Concernée

    Aucun correctif publié

  • parse-server npm

    Plages de versions concernées
    • SEMVER: < 4.10.14

    Mettez à jour vers 4.10.14

  • parse-server npm

    Plages de versions concernées
    • SEMVER: ≥ 5.0.0, < 5.2.5

    Mettez à jour vers 5.2.5

Sources originales

Vérifiez votre serveur →