PT-2025-46206 · Unknown+2 · Parse Server+2

Published 2025-11-10 · Updated 2025-11-13 · CVE-2025-64502

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.5.0-alpha.5

Description Parse Server, an open-source backend deployable on Node.js infrastructures, allows any client to execute MongoDB explain() queries without requiring the master key. The explain() method reveals detailed information about query execution plans, including database schema structure, field names, index configurations, query optimization details, query execution statistics, and performance metrics. This exposure can potentially reveal attack vectors for database performance exploitation. A new configuration option, databaseOptions.allowPublicExplain, was introduced in version 8.5.0-alpha.5 to restrict explain queries to the master key. This option defaults to true to maintain compatibility with existing deployments.

Recommendations Upgrade to version 8.5.0-alpha.5 or later. Implement middleware to block explain queries from non-master-key requests. Monitor and alert on explain query usage in production environments.

Exploit

Fix

Weakness Enumeration

CWE-201

Related Identifiers

BIT-PARSE-2025-64502

CVE-2025-64502

GHSA-7CX5-254X-CGRQ

Affected Products

Mongodb

Node.Js

Parse Server

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64502.json · Exploit
• https://osv.dev/vulnerability/BIT-parse-2025-64502 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cx5-254x-cgrq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64502 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64502 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-7cx5-254x-cgrq · Note
• https://github.com/parse-community/parse-server/pull/9890 · Note
• https://github.com/parse-community/parse-server/commit/4456b02280c2d8dd58b7250e9e67f1a8647b3452 · Note
• https://twitter.com/VolerionSec/status/1988010185487503690 · Twitter Post
• https://twitter.com/CVEnew/status/1988003180123189279 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1988165552309764400 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ow3bmx/resumen_diario_de_vulnerabilidades_13112025 · Reddit Post