GitHub Advisoryadvisory · npm
GHSA-crrq-vr9j-fxxh Protected fields exposed via LiveQuery
HIGH
Official page ↗
- Aliases
- CVE-2022-31112
- Ecosystem
- npm
- Packages
- parse-server
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weaknesses
- CWE-200, CWE-212
- Reviewed
- 2022-07-06
Affected packages
• npm parse-server: < 4.10.13 → fixed in 4.10.13
• npm parse-server: >= 5.0.0, < 5.2.4 → fixed in 5.2.4
Description
Impact
Parse Server LiveQuery does not remove protected fields in classes, passing them to the client.
Patches
The LiveQueryController now removes protected fields from the client response.
Workarounds
Use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
References
• https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
• https://github.com/parse-community/parse-server
For more information
If you have any questions or comments about this advisory:
• For questions or comments about this vulnerability visit our community forum or community chat
• Report other vulnerabilities at report.parseplatform.org
Related
Alias · CVE (1)
- CVE-2022-31112 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. vulnerability
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh web
- https://nvd.nist.gov/vuln/detail/CVE-2022-31112 advisory
- https://github.com/parse-community/parse-server/issues/8073 web
- https://github.com/parse-community/parse-server/pull/8074 web
- https://github.com/parse-community/parse-server/commit/054f3e6ab01d66a0dcfb77725af28eac1485b375 web
- https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1 web
- https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6 web
- https://github.com/parse-community/parse-server package
- https://github.com/parse-community/parse-server/releases/tag/5.2.4 web