PT-2022-20517 · Unknown · Parse Server

Mtrezza · Published 2022-06-20 · Updated 2024-03-06 · CVE-2022-31089

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.12 Parse Server versions prior to 5.2.3

Description The issue arises from the improper handling of certain types of invalid file requests, which can cause the server to crash. The availability impact may be low if multiple Parse Server instances are running in a cluster, but it may be high if Parse Server is running as a single instance without redundancy.

Recommendations For versions prior to 4.10.12, upgrade to version 4.10.12 or later. For versions prior to 5.2.3, upgrade to version 5.2.3 or later. As there are no known workarounds for this issue, upgrading to the specified versions is the recommended course of action.

Exploit

Fix

Unchecked Return Value

Weakness Enumeration

CWE-252

CWE-706

Related Identifiers

BIT-PARSE-2022-31089

CVE-2022-31089

GHSA-XW6G-JJVF-WWF9

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31089.json · Exploit
• https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31089 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2022-31089 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31089 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xw6g-jjvf-wwf9 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9 · Note
• https://t.me/cibsecurity/45239 · Telegram Post
• https://t.me/cvenotify/32266 · Telegram Post