In short
- CVE-2022-39313 is a HIGH (CVSS 7.5) vulnerability affecting parse-server (parseplatform), parse-server.
- Chance of exploitation in the next 30 days (EPSS): 0.81%, higher than 57.0% of all vulnerabilities.
- Fix: update to 5.2.8, 4.10.17 or later.
| Package | Affected versions | Patched versions |
|---|
| parse-server | ≥ 5.0.0, < 5.2.8< 4.10.17
| 5.2.84.10.17
|
| parse-server npm | ≥ 5.0.0, < 5.2.8< 4.10.17
| 5.2.84.10.17
|
Description
Impact
Parse Server crashes when a file download request is received with an invalid byte range.
Patches
Improved parsing of the range parameter to properly handle invalid range requests.
Workarounds
None
References
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been patched in versions 4.10.17, and 5.2.8. There are no known workarounds.
More vulnerabilities in parse-server
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free