CVE-2022-41879CWE-1321

Parse Server subject to Prototype pollution via Cloud Code Webhooks

High · published November 10, 2022

CVSS v3.1
7.2
EPSS
1%
Percentile
58.7
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00880 · 58.7th percentile
Weakness
CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Published
2022-11-10T00:00Z
EPSS history
Timeline
  • 10 NOV 00:00Z
    Parse Server subject to Prototype pollution via Cloud Code Webhooks
    cvelistv5