CVE-2025-64430

Katalog CVE

CVSS 7.5 · High EPSS 0,65%

Kerentanan Server-Side Request Forgery (SSRF). Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3.1-alpha.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality when trying to upload a Parse.File with uri parameter, allowing execution of an arbitrary URI. The vulnerability stems from a file upload feature in which Parse Server retrieves the file data from a URI that is provided in the request. A request to the provided URI is executed, but the response is not stored in Parse Server's file storage as the server crashes upon receiving the response. This issue is fixed in versions 7.5.4 and 8.4.0-alpha.1.

Rincian

Terbit di NVD

7 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51
• https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585
• https://github.com/parse-community/parse-server/pull/9903
• https://github.com/parse-community/parse-server/pull/9904
• https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx