Invalid push request payload crashes Parse Server

높음 7.5CVE-2023-32688 · GHSA-mxhg-rvwx-x993 · Published 27/05/2023 · updated 17/06/2026

요약

CVE-2023-32688은(는) parse server push adapter (parseplatform), parse-server-push-adapter에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.90%, 전체 취약점의 59.7%보다 높음.
조치: 4.1.3 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
parse server push adapter parseplatform	`< 4.1.3`	`4.1.3`
parse-server-push-adapter npm	`< 4.1.3`	`4.1.3`

Description

Impact

The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

Patches

Invalid push notification payload is caught and an logged.

Workarounds

n/a

References

NVD description

parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.

References

parse-community/parse-server-push-adapter security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-32688 · ADVISORY
parse-community/parse-server-push-adapter#217 · WEB
parse-community/parse-server-push-adapter commit 598cb84 · WEB
parse-community/parse-server-push-adapter · PACKAGE
parse-community/parse-server-push-adapter release 4.1.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free