CVE-2019-1020012
published 2019-07-29CVE-2019-1020012: parse-server before 3.4.1 allows DoS after any POST to a volatile class.
PriorityP335high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
1.40%
69.1th percentile
parse-server before 3.4.1 allows DoS after any POST to a volatile class.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse | parse-server | < 3.4.1 | 3.4.1 |
| parse | parse-server | >= 0 < 3.4.1 | 3.4.1 |
| parseplatform | parse-server | < 3.4.1 | 3.4.1 |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Parse Server before v3.4.1 vulnerable to Denial of Service
ghsa·2019-06-13
CVE-2019-1020012 [HIGH] CWE-444 Parse Server before v3.4.1 vulnerable to Denial of Service
Parse Server before v3.4.1 vulnerable to Denial of Service
### Impact
If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).
### Patches
Afflicted installations will also have to remove the offending collection from their database.
Yes, patched in 3.4.1
### Workarounds
Yes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5
### References
Nothing other than this advisory at this time
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [parse-server](https://github.com/parse-community/parse-server)
* Email us at [[email protected]](mailto:[email protected])
OSV
Parse Server before v3.4.1 vulnerable to Denial of Service
osv·2019-06-13
CVE-2019-1020012 [HIGH] Parse Server before v3.4.1 vulnerable to Denial of Service
Parse Server before v3.4.1 vulnerable to Denial of Service
### Impact
If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).
### Patches
Afflicted installations will also have to remove the offending collection from their database.
Yes, patched in 3.4.1
### Workarounds
Yes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5
### References
Nothing other than this advisory at this time
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [parse-server](https://github.com/parse-community/parse-server)
* Email us at [[email protected]](mailto:[email protected])
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-07-29
Published