En bref
- CVE-2024-27298 est une vulnérabilité CRITIQUE (CVSS 10.0) touchant parse-server (parseplatform), parse-server.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 63.7% des vulnérabilités.
- Correctif : mettre à jour vers 6.5.0, 7.0.0-alpha.20 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 6.5.0= 7.0.0< 6.5.0
| 6.5.0
|
| parse-server npm | ≥ 7.0.0-alpha.1, < 7.0.0-alpha.20< 6.5.0
| 7.0.0-alpha.206.5.0
|
Description
Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
Patches
The algorithm to detect SQL injection has been improved.
Workarounds
None.
References
Credits
- Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)
- Ehsan Persania (remediation developer)
- Manuel Trezza (coordinator)
NVD description
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free