CVE-2021-39187: Vulnerability in Bitnami Parse Server
Summary
CVE-2021-39187: Crash server with query parameter. Affects parse versions < 4.10.3. Fixed in 4.10.3. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2021-39187 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Bitnami Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides a platform for building scalable and flexible applications. Parse Server utilizes the MongoDB Node.js driver for database operations.
Vulnerability Detail
Prior to version 4.10.3, Parse Server is vulnerable to a crash when a query request contains an invalid value for the explain option. This vulnerability is caused by a bug in the MongoDB Node.js driver, which throws an exception that Parse Server cannot catch. The impact of this vulnerability is a denial of service, as the server crashes and becomes unresponsive. The issue has been patched in version 4.10.3.
How To Fix
Minimum fixed version
4.10.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds exist for this vulnerability. Upgrading to the patched version is the only solution.
Conclusion
The vulnerability in Bitnami Parse Server (CVE-2021-39187) can lead to a denial of service. It is recommended to upgrade to version 4.10.3 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
Parse Server is an open source backend that allows developers to build scalable applications using Node.js.
The vulnerability can cause a denial of service, as the server crashes when a query request with an invalid explain option is received.
To fix this vulnerability, upgrade Parse Server to version 4.10.3 or later.
No, there are no known workarounds for this vulnerability.
You can find more information about this vulnerability in the official Bitnami vulnerability database.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
