PT-2021-24384 · Parse Platform · Parse Server
Published
2021-09-07
·
Updated
2021-09-07
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions:
Parse Server versions 4.0.0-beta1 through 4.9.3
Description:
A security incident led to incorrect version tags being pushed to the Parse Server repository, potentially introducing security vulnerabilities. These tags were not reviewed or approved by Parse Platform. Although no releases were published with these incorrect versions, dependencies could still be defined using these version tags. The issue was first identified on July 21, 2021. Users of the Bitnami image for Parse Server may also be affected, as it picked up the incorrect version tag 4.9.3. There have been reports of functionality not working as expected, but no malicious code or concerns related to privacy, security, or legality have been found.
Recommendations:
Upgrade to version 4.10.0 to resolve the issue.
As a temporary workaround, consider downgrading to version 4.5.2 until the upgrade to 4.10.0 can be applied.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Parse Server