What is CVE-2022-31089?

CVE-2022-31089 is a vulnerability in Parse Server, an open source backend that can be used with Node.js, where certain types of invalid file requests are not handled properly and can crash the server.

What is the severity of CVE-2022-31089?

The severity of CVE-2022-31089 is high, with a CVSS score of 7.5.

How does CVE-2022-31089 impact Parse Server instances?

CVE-2022-31089 can cause the server to crash if it receives certain types of invalid file requests.

Which versions of Parse Server are affected by CVE-2022-31089?

Parse Server versions up to (but not including) 4.10.12 and versions 5.0.0 up to (but not including) 5.2.3 are affected by CVE-2022-31089.

How can I fix CVE-2022-31089?

To fix CVE-2022-31089, update Parse Server to a version that is not affected by the vulnerability.

Vulnerability/
CVE-2022-31089

high

7.5

CWE

252 706

27/6/2022

3/8/2024

CVE-2022-31089: Invalid file request can crashe parse-server

First published: Mon Jun 27 2022(Updated: )

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be high. This issue has been addressed in versions 4.10.12 and 5.2.3. Users are advised to upgrade. There are no known workarounds for this issue.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Parseplatform Parse-server	<4.10.12
Parseplatform Parse-server	>=5.0.0<5.2.3

Remedy

https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2022-31089?
CVE-2022-31089 is a vulnerability in Parse Server, an open source backend that can be used with Node.js, where certain types of invalid file requests are not handled properly and can crash the server.
What is the severity of CVE-2022-31089?
The severity of CVE-2022-31089 is high, with a CVSS score of 7.5.
How does CVE-2022-31089 impact Parse Server instances?
CVE-2022-31089 can cause the server to crash if it receives certain types of invalid file requests.
Which versions of Parse Server are affected by CVE-2022-31089?
Parse Server versions up to (but not including) 4.10.12 and versions 5.0.0 up to (but not including) 5.2.3 are affected by CVE-2022-31089.
How can I fix CVE-2022-31089?
To fix CVE-2022-31089, update Parse Server to a version that is not affected by the vulnerability.

collector/nvd-index
agent/references
agent/weakness
agent/softwarecombine
agent/type
collector/mitre-cve
source/MITRE
agent/title
agent/author
agent/last-modified-date
agent/severity
agent/remedy
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/parseplatform
canonical/parseplatform parse-server
version/parseplatform parse-server/5.0.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.