Parse Server may crash when uploading file without extension

高 7.5CVE-2023-46119 · BIT-parse-2023-46119 · GHSA-792q-q67h-w579 · 25/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-46119 は parse-server (parseplatform), parse-server に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.3%（全脆弱性の 70.8% より高い）。
対処：5.5.6, 6.3.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
parse-server parseplatform	`≥ 1.0.0, < 5.5.6≥ 6.0.0, < 6.3.1`	`5.5.66.3.1`
parse-server npm	`≥ 1.0.0, < 5.5.6≥ 6.0.0, < 6.3.1`	`5.5.66.3.1`

概要

Impact

Parse Server crashes when uploading a file without extension.

Patches

A permanent fix has been implemented to prevent the server from crashing.

Workarounds

There are no known workarounds.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
Patched in Parse Server 6: https://github.com/parse-community/parse-server/releases/tag/6.3.1
Patched in Parse Server 5 (LTS): https://github.com/parse-community/parse-server/releases/tag/5.5.6

NVD の説明

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.