GHSA-2479-QVV7-47QQ高危已审查

Parse Server before v3.4.1 vulnerable to Denial of Service

OSV 1.4.0 · github-reviewed · 修改于 2022-09-14 06:16

发布时间

2019-06-14 00:22

GitHub 审查时间

2020-06-17 04:51

NVD 发布时间

—

源文件

advisories/github-reviewed/2019/06/GHSA-2479-qvv7-47qq/GHSA-2479-qvv7-47qq.json

公告说明

Impact

If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).

Patches

Afflicted installations will also have to remove the offending collection from their database.

Yes, patched in 3.4.1

Workarounds

Yes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5

References

Nothing other than this advisory at this time

For more information

If you have any questions or comments about this advisory:

Open an issue in parse-server
Email us at [email protected]

受影响的软件包

npm

parse-server

标识信息

别名 / CVE

CVE-2019-1020012

CWE

CWE-444

软件生态

npm

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

原始 OSV JSON

{
  "id": "GHSA-2479-qvv7-47qq",
  "aliases": [
    "CVE-2019-1020012"
  ],
  "details": "### Impact\n\nIf a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).\n\n\n### Patches\nAfflicted installations will also have to remove the offending collection from their database.\n\nYes, patched in 3.4.1\n\n### Workarounds\n\nYes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5\n\n### References\nNothing other than this advisory at this time\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [parse-server](https://github.com/parse-community/parse-server)\n* Email us at [[email protected]](mailto:[email protected])\n",
  "summary": "Parse Server before v3.4.1 vulnerable to Denial of Service",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.4.1"
            }
          ]
        }
      ],
      "package": {
        "name": "parse-server",
        "ecosystem": "npm"
      }
    }
  ],
  "modified": "2022-09-13T22:16:02Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
  "published": "2019-06-13T16:22:13Z",
  "references": [
    {
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-2479-qvv7-47qq",
      "type": "WEB"
    },
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1020012",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/advisories/GHSA-2479-qvv7-47qq",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/parse-community/parse-server",
      "type": "PACKAGE"
    },
    {
      "url": "https://snyk.io/vuln/SNYK-JS-PARSESERVER-455635",
      "type": "WEB"
    },
    {
      "url": "https://www.npmjs.com/advisories/1113",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2020-06-16T20:51:19Z"
  }
}