CVE-2024-47183

Katalog CVE

CVSS 8.1 · High EPSS 0,42%

Kerentanan Improper Authorization pada parseplatform parse-server. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Rincian

Terbit di NVD

4 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg advisory vendor
• https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc patch
• https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f patch
• https://github.com/parse-community/parse-server/pull/9317 patch
• https://github.com/parse-community/parse-server/pull/9318 patch