CVE-2022-31089CWE-252CWE-706

Invalid file request can crashe parse-server

High · published June 27, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
66.2
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be high. This issue has been addressed in versions 4.10.12 and 5.2.3. Users are advised to upgrade. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01131 · 66.2th percentile
Weaknesses
CWE-252 · Unchecked Return Value; CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2022-06-27T21:10Z
EPSS history
Timeline
  • 27 JUN 21:10Z
    Invalid file request can crashe parse-server
    cvelistv5