What is CVE-2021-39187?

CVE-2021-39187 is a vulnerability that causes Parse Server to crash when a query request contains an invalid value for the 'explain' option.

How does CVE-2021-39187 impact Parse Server?

CVE-2021-39187 can cause Parse Server to crash when a query request contains an invalid value for the 'explain' option.

What software versions are affected by CVE-2021-39187?

Prior to version 4.10.3, Parse Server is affected by CVE-2021-39187.

What is the severity level of CVE-2021-39187?

CVE-2021-39187 has a severity level of 7.5 (High).

How can CVE-2021-39187 be fixed?

To fix CVE-2021-39187, update Parse Server to version 4.10.3 or higher, where the bug in the MongoDB Node.js driver has been fixed.

Vulnerability/
CVE-2021-39187

high

7.5

CWE

755 74

2/9/2021

4/8/2024

CVE-2021-39187: Crash server with query parameter

First published: Thu Sep 02 2021(Updated: )

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Parseplatform Parse-server	<4.10.3

Remedy

https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec

Remedy

https://jira.mongodb.org/browse/NODE-3463

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2021-39187?
CVE-2021-39187 is a vulnerability that causes Parse Server to crash when a query request contains an invalid value for the 'explain' option.
How does CVE-2021-39187 impact Parse Server?
CVE-2021-39187 can cause Parse Server to crash when a query request contains an invalid value for the 'explain' option.
What software versions are affected by CVE-2021-39187?
Prior to version 4.10.3, Parse Server is affected by CVE-2021-39187.
What is the severity level of CVE-2021-39187?
CVE-2021-39187 has a severity level of 7.5 (High).
How can CVE-2021-39187 be fixed?
To fix CVE-2021-39187, update Parse Server to version 4.10.3 or higher, where the bug in the MongoDB Node.js driver has been fixed.

collector/nvd-index
agent/references
agent/weakness
agent/type
agent/remedy
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/title
agent/author
agent/severity
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/parseplatform
canonical/parseplatform parse-server

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.