by Kastro
Paper/Archive/CVE-2023-36475

CVE-2023-36475

parse-community parse-server — Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.1.881 × 2017.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.

Affected

ProductAffectedFixed inSource
parse-server< 5.5.2–CNA
parse-server>= 6.0.0, < 6.2.1–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6refgithub.com/parse-community/parse-server/issues/8674refgithub.com/parse-community/parse-server/issues/8675refgithub.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90refgithub.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81frefgithub.com/parse-community/parse-server/releases/tag/5.5.2refgithub.com/parse-community/parse-server/releases/tag/6.2.1