CVE-2021-39187: Crash server with query parameter
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Parse Serverto a version that resolves this vulnerability.Fixed in 4.10.3
Event History
Frequently Asked Questions
What is CVE-2021-39187?
CVE-2021-39187 is a vulnerability that causes Parse Server to crash when a query request contains an invalid value for the 'explain' option.
How does CVE-2021-39187 impact Parse Server?
CVE-2021-39187 can cause Parse Server to crash when a query request contains an invalid value for the 'explain' option.
What software versions are affected by CVE-2021-39187?
Prior to version 4.10.3, Parse Server is affected by CVE-2021-39187.
What is the severity level of CVE-2021-39187?
CVE-2021-39187 has a severity level of 7.5 (High).
How can CVE-2021-39187 be fixed?
To fix CVE-2021-39187, update Parse Server to version 4.10.3 or higher, where the bug in the MongoDB Node.js driver has been fixed.