GitHub Advisoryadvisory · npm

GHSA-qf8x-vqjv-92gr Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter

HIGH Published 2022-05-04 Modified 2022-06-02 Official page ↗
Aliases
CVE-2022-24901
Ecosystem
npm
Packages
parse-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-287, CWE-295
Reviewed
2022-05-04

Affected packages

• npm parse-server: < 4.10.10 → fixed in 4.10.10 • npm parse-server: >= 5.0.0, < 5.2.1 → fixed in 5.2.1

Description

Impact Weak validation of the Apple certificate URL in the Apple Game Center authentication adapter allows to bypass authentication and makes the server vulnerable to DoS attacks. Patches The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.

Related

Alias · CVE (1)

  • CVE-2022-24901 Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication,… vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-295 Improper Certificate Validation weakness

References