In short
- CVE-2024-27298 is a CRITICAL (CVSS 10.0) vulnerability affecting parse-server (parseplatform), parse-server.
- Chance of exploitation in the next 30 days (EPSS): 1.0%, higher than 63.7% of all vulnerabilities.
- Fix: update to 6.5.0, 7.0.0-alpha.20 or later.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 6.5.0= 7.0.0< 6.5.0
| 6.5.0
|
| parse-server npm | ≥ 7.0.0-alpha.1, < 7.0.0-alpha.20< 6.5.0
| 7.0.0-alpha.206.5.0
|
Description
Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
Patches
The algorithm to detect SQL injection has been improved.
Workarounds
None.
References
Credits
- Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)
- Ehsan Persania (remediation developer)
- Manuel Trezza (coordinator)
NVD description
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
More vulnerabilities in parse-server
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free