CVE - CVE-2023-36475

CVE-ID
CVE-2023-36475	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90 URL:https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90 MISC:https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f URL:https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f MISC:https://github.com/parse-community/parse-server/issues/8674 URL:https://github.com/parse-community/parse-server/issues/8674 MISC:https://github.com/parse-community/parse-server/issues/8675 URL:https://github.com/parse-community/parse-server/issues/8675 MISC:https://github.com/parse-community/parse-server/releases/tag/5.5.2 URL:https://github.com/parse-community/parse-server/releases/tag/5.5.2 MISC:https://github.com/parse-community/parse-server/releases/tag/6.2.1 URL:https://github.com/parse-community/parse-server/releases/tag/6.2.1 MISC:https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 URL:https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20230621	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20230621)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)