Kurz gesagt
- CVE-2024-27298 ist eine Schwachstelle (KRITISCH (CVSS 10.0)) in parse-server (parseplatform), parse-server.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.0%, höher als bei 63.7% aller Schwachstellen.
- Abhilfe: auf 6.5.0, 7.0.0-alpha.20 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 6.5.0= 7.0.0< 6.5.0
| 6.5.0
|
| parse-server npm | ≥ 7.0.0-alpha.1, < 7.0.0-alpha.20< 6.5.0
| 7.0.0-alpha.206.5.0
|
Description
Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
Patches
The algorithm to detect SQL injection has been improved.
Workarounds
None.
References
Credits
- Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)
- Ehsan Persania (remediation developer)
- Manuel Trezza (coordinator)
NVD description
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free