CVE-2023-46119

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Relative Path Traversal pada parseplatform parse-server. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.

Rincian

Terbit di NVD

25 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-23: Relative Path Traversal
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 63,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579 advisory vendor
• https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe patch
• https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0 patch
• https://github.com/parse-community/parse-server/releases/tag/5.5.6 release notes
• https://github.com/parse-community/parse-server/releases/tag/6.3.1 release notes