p PatchFirst

CVE-2022-24901

CVE-2022-24901 · Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • parse-server

    Versions
    • < 4.10.10: Affected
    • >= 5.0.0, < 5.2.1: Affected

    No fix published

  • parse-server npm

    Affected ranges
    • SEMVER: < 4.10.10

    Update to 4.10.10

  • parse-server npm

    Affected ranges
    • SEMVER: ≥ 5.0.0, < 5.2.1

    Update to 5.2.1

Original sources

Check your server →