NVD

CVE-2024-47183 Detail

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

CNA: GitHub, Inc.

Base Score: 8.1 HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc	Patch
https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f	Patch
https://github.com/parse-community/parse-server/pull/9317	Patch
https://github.com/parse-community/parse-server/pull/9318	Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg	Vendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-863	Incorrect Authorization	NIST
CWE-285	Improper Authorization	GitHub, Inc.

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

2 change records found show changes

Initial Analysis by NIST 11/13/2024 4:15:50 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		OR cpe:2.3:a:parseplatform:parse_server::::::::* versions up to (excluding) 6.5.9 cpe:2.3:a:parseplatform:parse_server::::::::* versions from (including) 7.0.0 up to (excluding) 7.3.0
Added	CVSS V3.1		NIST AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Added	CWE		NIST CWE-863
Changed	Reference Type	https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc No Types Assigned	https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc Patch
Changed	Reference Type	https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f No Types Assigned	https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f Patch
Changed	Reference Type	https://github.com/parse-community/parse-server/pull/9317 No Types Assigned	https://github.com/parse-community/parse-server/pull/9317 Patch
Changed	Reference Type	https://github.com/parse-community/parse-server/pull/9318 No Types Assigned	https://github.com/parse-community/parse-server/pull/9318 Patch
Changed	Reference Type	https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg No Types Assigned	https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg Vendor Advisory

New CVE Received by NIST 10/04/2024 11:15:13 AM

Action	Type	New Value
Added	CVSS V3.1	GitHub, Inc. AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Added	CWE	GitHub, Inc. CWE-285
Added	Description	Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.
Added	Reference	GitHub, Inc. https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc [No types assigned]
Added	Reference	GitHub, Inc. https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f [No types assigned]
Added	Reference	GitHub, Inc. https://github.com/parse-community/parse-server/pull/9317 [No types assigned]
Added	Reference	GitHub, Inc. https://github.com/parse-community/parse-server/pull/9318 [No types assigned]
Added	Reference	GitHub, Inc. https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg [No types assigned]

Quick Info

CVE Dictionary Entry:
CVE-2024-47183
NVD Published Date:
10/04/2024
NVD Last Modified:
11/13/2024
Source:
GitHub, Inc.

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database