PT-2021-22398 · Unknown · Parse Server

Cbaker6 + 1 · Published 2021-08-18 · Updated 2024-03-06 · CVE-2021-39138

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.5.1

Description The issue arises when an anonymous user is first signed up using the REST API, causing the server to create a session incorrectly. Specifically, the authProvider field in the Session class under createdWith shows the user as logged in with a password. This incorrect classification affects developers who depend on the createdWith field to provide different levels of access between password users and anonymous users. The server does not currently use createdWith for internal decision-making, so developers not using it directly are not affected.

Recommendations For versions prior to 4.5.1, upgrade to version 4.5.1 to resolve the issue. As a temporary workaround, do not use the createdWith Session field to make decisions if anonymous login is allowed.

Fix

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

BIT-PARSE-2021-39138

CVE-2021-39138

GHSA-23R4-5MXP-C7G5

Affected Products

Parse Server

References · 11

• https://github.com/parse-community/parse-server/commit/147bd9a3dc43391e92c36e05d5db860b04ca27db · Patch
• https://osv.dev/vulnerability/BIT-parse-2021-39138 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-39138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-39138 · Security Note
• https://osv.dev/vulnerability/GHSA-23r4-5mxp-c7g5 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/4.5.1 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-23r4-5mxp-c7g5 · Note
• https://github.com/parse-community/parse-server/releases/tag/4.5.2 · Note
• https://t.me/cibsecurity/27608 · Telegram Post
• https://t.me/cvenotify/19766 · Telegram Post