PT-2023-23963 · Unknown · Parse-Server-Push-Adapter

Mtrezza · Publicado 2023-05-22 · Atualizado 2023-06-02 · CVE-2023-32688

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions parse-server-push-adapter versions prior to 4.1.3

Description The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 to resolve the issue. As a temporary workaround, consider implementing input validation to prevent invalid push notification payloads from crashing the server.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-32688

GHSA-MXHG-RVWX-X993

Produtos afetados

Parse-Server-Push-Adapter

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/32xxx/CVE-2023-32688.json · Exploit
• https://github.com/parse-community/parse-server-push-adapter/pull/217 · Correção
• https://github.com/parse-community/parse-server-push-adapter/releases/tag/4.1.3 · Nota
• https://github.com/parse-community/parse-server-push-adapter/commit/598cb84d0866b7c5850ca96af920e8cb5ba243ec · Nota
• https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993 · Aviso do Fabricante
• https://github.com/parse-community/parse-server-push-adapter · Nota
• https://t.me/cvenotify/51646 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-32688 · Aviso do Fabricante
• https://t.me/cibsecurity/64737 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-mxhg-rvwx-x993 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-32688 · Nota de Segurança