Crash server with query parameter
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-39187US | high7.5 | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contai… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ecADVISORY
- https://github.com/parse-community/parse-server/releases/tag/4.10.3ADVISORY
- https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6xADVISORY
- https://jira.mongodb.org/browse/NODE-3463ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2021-39187WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan