In breve
- CVE-2024-27298 è una vulnerabilità CRITICO (CVSS 10.0) che riguarda parse-server (parseplatform), parse-server.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 63.7% delle vulnerabilità.
- Correzione: aggiornare a 6.5.0, 7.0.0-alpha.20 o successiva.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 6.5.0= 7.0.0< 6.5.0
| 6.5.0
|
| parse-server npm | ≥ 7.0.0-alpha.1, < 7.0.0-alpha.20< 6.5.0
| 7.0.0-alpha.206.5.0
|
Description
Impact
This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database.
Patches
The algorithm to detect SQL injection has been improved.
Workarounds
None.
References
Credits
- Mikhail Shcherbakov (https://twitter.com/yu5k3) working with Trend Micro Zero Day Initiative (finder)
- Ehsan Persania (remediation developer)
- Manuel Trezza (coordinator)
NVD description
parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free