by Kastro
Paper/Archive/CVE-2024-27298

CVE-2024-27298

parse-community parse-server — Parse Server literalizeRegexPart SQL Injection

EPSS 1%public exploitCVSS 10.0
critical.is priorityof 100
53
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 63.7.637 × 2012.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

Affected

ProductAffectedFixed inSource
parse-server< 6.5.0–CNA
parse-server>= 7.0.0-alpha.1, < 7.0.0-alpha.20–CNA
parse-server< 6.5.06.5.0CISA-ADP
parse-server7.0.0-alpha.1 – < 7.0.0-alpha.207.0.0-alpha.20CISA-ADP

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refgithub.com/parse-community/parse-server/security/advisories/GHSA-6927-3vr9-fxf2refgithub.com/parse-community/parse-server/commit/a6e654943536932904a69b51e513507fcf90a504refgithub.com/parse-community/parse-server/commit/cbefe770a7260b54748a058b8a7389937dc35833refgithub.com/parse-community/parse-server/releases/tag/6.5.0refgithub.com/parse-community/parse-server/releases/tag/7.0.0-alpha.20