CVE-2024-39309

CVSS V2 None CVSS V3 None
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
Overview
  • CVE ID
  • CVE-2024-39309
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2024-07-01T21:15:26.242Z
  • Last Modified Date
  • 2024-07-01T21:15:26.242Z
Weakness Enumerations
CWE URL
CWE-288 http://cwe.mitre.org/data/definitions/288.html
CWE-89 http://cwe.mitre.org/data/definitions/89.html
References
Reference URL Reference Tags
https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r x_refsource_CONFIRM
https://github.com/parse-community/parse-server/pull/9167 x_refsource_MISC
https://github.com/parse-community/parse-server/pull/9168 x_refsource_MISC
https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3 x_refsource_MISC
https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2024-39309
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39309
History
Created Old Value New Value Data Type Notes
2024-07-02 13:09:52 Added to TrackCVE