← Back

CVE-2024-27298

nvd nist
Published: Mar 1, 2024Modified: Jun 17, 2026

JSON object

Loading...
10.0
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Exploitability: 3.9 / Impact: 5.8
Source: security-advisories@github.com (Secondary)

Description

parse-server is a Parse Server for Node.js / Express. This vulnerability allows SQL injection when Parse Server is configured to use the PostgreSQL database. The vulnerability has been fixed in 6.5.0 and 7.0.0-alpha.20.

Affected (23)

Parseplatform
1 product
Parse Server
Configuration A
23 vulnerable
Vulnerable SoftwareAffected Versions
Parseplatform
Parse Server
Before 6.5.0
Parse Server
Version 6.5.0 alpha1
Parse Server
Version 6.5.0 alpha2
Parse Server
Version 6.5.0 beta1
Parse Server
Version 7.0.0 alpha10
Parse Server
Version 7.0.0 alpha11
Parse Server
Version 7.0.0 alpha12
Parse Server
Version 7.0.0 alpha13
Parse Server
Version 7.0.0 alpha14
Parse Server
Version 7.0.0 alpha15
Parse Server
Version 7.0.0 alpha16
Parse Server
Version 7.0.0 alpha17
Parse Server
Version 7.0.0 alpha18
Parse Server
Version 7.0.0 alpha19
Parse Server
Version 7.0.0 alpha1
Parse Server
Version 7.0.0 alpha2
Parse Server
Version 7.0.0 alpha3
Parse Server
Version 7.0.0 alpha4
Parse Server
Version 7.0.0 alpha5
Parse Server
Version 7.0.0 alpha6
Parse Server
Version 7.0.0 alpha7
Parse Server
Version 7.0.0 alpha8
Parse Server
Version 7.0.0 alpha9

Related CWEs

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

References (10)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Release Notes
Source: security-advisories@github.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.