CVE-2022-31112CWE-200

Protected fields exposed via LiveQuery in parse-server

High · published June 30, 2022

CVSS v3.1
8.2
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01304 · 70.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2022-06-30T16:40Z
EPSS history
Timeline
  • 30 JUN 16:40Z
    Protected fields exposed via LiveQuery in parse-server
    cvelistv5