CVE-2022-41879
Fixed upstream EPSS <1%CVSS 7.2
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 5.3.3 or 4.10.20, a compromised Parse Server Cloud Code Webhook target endpoint allows an attacker to use prototype pollution to bypass the Parse Server `requestKeywordDenylist` option. This issue has been patched in versions 5.3.3 and 4.10.20. There are no known workarounds.
Products: parse-community parse-server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | parse-server | 4.10.20 |
| npm | parse-server | 5.3.3 |