CVE-2024-29027

parseplatform parse-server

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-29027

Katalog CVE

CVSS 9.0 · Critical EPSS 1,2%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada parseplatform parse-server. Skor CVSS 3.1 9.0 (Critical) menurut github.com.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.

Rincian

Terbit di NVD
19 Maret 2024
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
9.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
EPSS (30 hari)
1,2% peluang dieksploitasi; lebih tinggi dari 67,1% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
parseplatform parse-server Semua versi sebelum 6.5.5
parseplatform parse-server Versi 7.0.0 alpha1
parseplatform parse-server Versi 7.0.0 alpha10
parseplatform parse-server Versi 7.0.0 alpha11
parseplatform parse-server Versi 7.0.0 alpha12
parseplatform parse-server Versi 7.0.0 alpha13
parseplatform parse-server Versi 7.0.0 alpha14
parseplatform parse-server Versi 7.0.0 alpha15
parseplatform parse-server Versi 7.0.0 alpha16
parseplatform parse-server Versi 7.0.0 alpha17
parseplatform parse-server Versi 7.0.0 alpha18
parseplatform parse-server Versi 7.0.0 alpha19
parseplatform parse-server Versi 7.0.0 alpha2
parseplatform parse-server Versi 7.0.0 alpha20
parseplatform parse-server Versi 7.0.0 alpha21
parseplatform parse-server Versi 7.0.0 alpha22
parseplatform parse-server Versi 7.0.0 alpha23
parseplatform parse-server Versi 7.0.0 alpha24
parseplatform parse-server Versi 7.0.0 alpha25
parseplatform parse-server Versi 7.0.0 alpha26
parseplatform parse-server Versi 7.0.0 alpha27
parseplatform parse-server Versi 7.0.0 alpha28
parseplatform parse-server Versi 7.0.0 alpha3
parseplatform parse-server Versi 7.0.0 alpha4
parseplatform parse-server Versi 7.0.0 alpha5
parseplatform parse-server Versi 7.0.0 alpha6
parseplatform parse-server Versi 7.0.0 alpha7
parseplatform parse-server Versi 7.0.0 alpha8
parseplatform parse-server Versi 7.0.0 alpha9

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.