GitHub Advisoryadvisory · npm
GHSA-mxhg-rvwx-x993 Invalid push request payload crashes Parse Server
MEDIUM
Official page ↗
- Aliases
- CVE-2023-32688
- Ecosystem
- npm
- Packages
- parse-server-push-adapter
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-20
- Reviewed
- 2023-05-22
Affected packages
• npm parse-server-push-adapter: < 4.1.3 → fixed in 4.1.3
Description
Impact
The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.
Patches
Invalid push notification payload is caught and an logged.
Workarounds
n/a
References
• https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993
• https://github.com/parse-community/parse-server-push-adapter/pull/217
Related
Alias · CVE (1)
- CVE-2023-32688 parse-server-push-adapter is the official Push Notification adapter for Parse Server. vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993 web
- https://nvd.nist.gov/vuln/detail/CVE-2023-32688 advisory
- https://github.com/parse-community/parse-server-push-adapter/pull/217 web
- https://github.com/parse-community/parse-server-push-adapter/commit/598cb84d0866b7c5850ca96af920e8cb5ba243ec web
- https://github.com/parse-community/parse-server-push-adapter package
- https://github.com/parse-community/parse-server-push-adapter/releases/tag/4.1.3 web