CVE-2022-31089: Open Source Vulnerability in Parse Server
Summary
CVE-2022-31089: Invalid file request can crashe parse-server. Affects parse across 2 version ranges.
< 4.10.12
>= 5.0.0, < 5.2.3
Fixed in 4.10.12 or 5.2.3, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2022-31089 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open source backend that can be deployed to any infrastructure running Node.js. It provides a platform for building scalable and flexible applications. However, certain types of invalid file requests in affected versions are not handled properly, leading to a server crash. This vulnerability can have a high impact on availability, especially for single instances without redundancy. Upgrading to versions 4.10.12 or 5.2.3 is recommended to mitigate this issue.
Vulnerability Detail
The vulnerability in Parse Server arises from the improper handling of certain types of invalid file requests. When these requests are encountered, the server crashes, impacting the availability of the application. This vulnerability can be particularly severe for single instances of Parse Server without redundancy. It has been assigned the identifier CVE-2022-31089 and has a CVSSv3 score of 7.5 (High).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.10.124.10.12 -
>= 5.0.0, < 5.2.35.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the vulnerability in Parse Server can lead to server crashes and impact the availability of the application. It is crucial to upgrade to versions 4.10.12 or 5.2.3 to mitigate this issue. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for parse →
FAQ
Parse Server is an open source backend that allows developers to build scalable applications using Node.js.
The vulnerability can cause the server to crash, leading to a potential loss of availability for the application.
No, only certain versions of Parse Server are affected. Versions 4.10.12 and 5.2.3 address the vulnerability.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed versions is recommended.
To upgrade Parse Server, follow the upgrade instructions provided by the Parse Server documentation for the desired version.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
