CVE-2021-47986: parseplatform parse-server

csirt@kutim:~/threat-intel/cve/CVE-2021-47986

CVSS 7.5 · High EPSS 0,18%

Kerentanan Download of Code Without Integrity Check pada parseplatform parse-server. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.

Rincian

Terbit di NVD: 25 Juni 2026
Terakhir diubah: 30 Juli 2026
Status NVD: Analyzed
CVSS 3.1: 7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-494: Download of Code Without Integrity Check
EPSS (30 hari): 0,18% peluang dieksploitasi; lebih tinggi dari 6,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
parseplatform	parse-server	Versi 4.0.0 beta1
parseplatform	parse-server	Versi 4.0.0 beta2
parseplatform	parse-server	Versi 4.0.0 beta3
parseplatform	parse-server	Versi 4.0.0 beta4
parseplatform	parse-server	Versi 4.0.0 beta5
parseplatform	parse-server	Versi 4.0.0 beta6
parseplatform	parse-server	Versi 4.0.3
parseplatform	parse-server	Versi 4.0.4
parseplatform	parse-server	Versi 4.0.6
parseplatform	parse-server	Versi 4.0.7
parseplatform	parse-server	Versi 4.0.8
parseplatform	parse-server	Versi 4.0.9
parseplatform	parse-server	Versi 4.0.10
parseplatform	parse-server	Versi 4.0.11
parseplatform	parse-server	Versi 4.0.12
parseplatform	parse-server	Versi 4.0.13
parseplatform	parse-server	Versi 4.0.14
parseplatform	parse-server	Versi 4.6.0
parseplatform	parse-server	Versi 4.6.0 beta
parseplatform	parse-server	Versi 4.7.0
parseplatform	parse-server	Versi 4.8.0
parseplatform	parse-server	Versi 4.8.1
parseplatform	parse-server	Versi 4.8.2
parseplatform	parse-server	Versi 4.8.3
parseplatform	parse-server	Versi 4.8.4
parseplatform	parse-server	Versi 4.8.5
parseplatform	parse-server	Versi 4.9.0
parseplatform	parse-server	Versi 4.9.1
parseplatform	parse-server	Versi 4.9.2
parseplatform	parse-server	Versi 4.9.3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/parse-community/parse-server/security/advisories/GHSA-593v-wcqx-hq2w advisory vendor
https://www.vulncheck.com/advisories/parse-server-unreviewed-code-execution-via-malicious-version-tags advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.