CVE-2022-39225: Parse Server subject to Incorrect Resource Transfer Between Spheres
First published: Fri Sep 23 2022(Updated: )
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. For example, an attacker can assign the session object to their own user by writing to the `user` field and then read any custom fields of that session object. Note that assigning a session to another user does not usually change the privileges of either of the two users, and a user cannot assign their own session to another user. This issue is patched in version 4.10.15 and above, and 5.2.6 and above. To mitigate this issue in unpatched versions add a `beforeSave` trigger to the `_Session` class and prevent writing if the requesting user is different from the user in the session object.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Parseplatform Parse-server | <4.10.15 | |
| Parseplatform Parse-server | >=5.0.0<5.2.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-39225?
CVE-2022-39225 refers to a vulnerability in Parse Server that allows a user to write to the session object of another user if the session object ID is known.
What is the severity of CVE-2022-39225?
The severity of CVE-2022-39225 is medium, with a severity value of 3.1.
Which versions of Parse Server are affected by CVE-2022-39225?
Versions prior to 4.10.15, and 5.0.0 to 5.2.6 of Parse Server are affected by CVE-2022-39225.
How can an attacker exploit CVE-2022-39225?
An attacker can exploit CVE-2022-39225 by assigning the session object ID of another user and writing to their session object.
Is there a fix available for CVE-2022-39225?
Yes, the fix for CVE-2022-39225 is available in Parse Server version 4.10.15 and version 5.2.6.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/parseplatform
- canonical/parseplatform parse-server
- version/parseplatform parse-server/5.0.0