CVE-2023-36475

Katalog CVE

CVSS 9.8 · Critical EPSS 3,2%

Kerentanan Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pada parseplatform parse-server. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.

Rincian

Terbit di NVD

28 Juni 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

EPSS (30 hari)

3,2% peluang dieksploitasi; lebih tinggi dari 87,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 advisory vendor
• https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90 patch
• https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f patch
• https://github.com/parse-community/parse-server/issues/8674 issue tracking · patch
• https://github.com/parse-community/parse-server/issues/8675 issue tracking · patch
• https://github.com/parse-community/parse-server/releases/tag/5.5.2 release notes
• https://github.com/parse-community/parse-server/releases/tag/6.2.1 release notes