CVE-2021-39187

Katalog CVE

CVSS 7.5 · High EPSS 1,8%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada parseplatform parse-server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.

Rincian

Terbit di NVD

2 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-755: Improper Handling of Exceptional Conditions

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec patch · advisory pihak ketiga
• https://jira.mongodb.org/browse/NODE-3463 patch · advisory pihak ketiga
• https://github.com/parse-community/parse-server/releases/tag/4.10.3 advisory pihak ketiga
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6x advisory pihak ketiga