CVE-2022-24760
high-risk
Published 2022-03-12
Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.
Do I need to act?
!
75.6% chance of exploitation in next 30 days
EPSS score — higher than 24% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
+
Fix available
Upgrade to: 7c844772eaf8f12e0d2c175360a1a553e113bc2c
10
CVSS 10.0/10
Critical
NETWORK
/ LOW complexity
Affected Products (1)
Affected Vendors
References (6)
58
/ 100
high-risk
Severity
33/34 · Critical
Exploitability
20/34 · Moderate
Exposure
5/34 · Minimal