PT-2022-24895 · Unknown · Parse Server

Hej2010 · Published 2022-10-18 · Updated 2024-03-06 · CVE-2022-39313

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.17 Parse Server versions prior to 5.2.8 on the 5.x branch

Description The issue occurs when a file download request is received with an invalid byte range, causing the server to crash and resulting in a Denial of Service. The problem has been patched in versions 4.10.17 and 5.2.8.

Recommendations For versions prior to 4.10.17, update to version 4.10.17 or later. For versions prior to 5.2.8 on the 5.x branch, update to version 5.2.8 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-1284

Related Identifiers

BIT-PARSE-2022-39313

CVE-2022-39313

GHSA-H423-W6QV-2WJ3

Affected Products

Parse Server

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39313.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39313 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39313 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2022-39313 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h423-w6qv-2wj3 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/4.10.17 · Note
• https://github.com/parse-community/parse-server/commit/3d7a61ecd5231638f01ff1a965b6313043c594a7 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3 · Note
• https://github.com/parse-community/parse-server/commit/066f29673ab4030b6b5b90c0c0326f7d3fe7612a · Note
• https://t.me/cibsecurity/51986 · Telegram Post