CVE-2021-39187CWE-74

Crash server with query parameter

High · published September 2, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
78.6
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01819 · 78.6th percentile
Weakness
CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published
2021-09-02T15:35Z
EPSS history
Timeline
  • 02 SEP 15:35Z
    Crash server with query parameter
    cvelistv5