CVE-2022-24901

Published: May 4, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.

Affected (2)

Products: Parseplatform: Parse Server

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Parseplatform Parse Server	Before 4.10.10
Parseplatform Parse Server	From 5.0.0 to 5.2.1

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://github.com/parse-community/parse-server/security/advisories/GHSA-qf8x-vqjv-92gr

Source: security-advisories@github.com

Issue TrackingThird Party Advisory

https://github.com/parse-community/parse-server/security/advisories/GHSA-qf8x-vqjv-92gr

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.