CVE-2022-24901
published 2022-05-04CVE-2022-24901: Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.64%
46.0th percentile
Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 4.10.10 | 4.10.10 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 4.10.10 | 4.10.10 |
| parse-community | parse-server | >= 5.0.0 < 5.2.1 | 5.2.1 |
| parseplatform | parse-server | < 4.10.10 | 4.10.10 |
| parseplatform | parse-server | >= 5.0.0 < 5.2.1 | 5.2.1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
osv·2022-05-04
CVE-2022-24901 [HIGH] Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
### Impact
Weak validation of the Apple certificate URL in the Apple Game Center authentication adapter allows to bypass authentication and makes the server vulnerable to DoS attacks.
### Patches
The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
GHSA
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
ghsa·2022-05-04
CVE-2022-24901 [HIGH] CWE-287 Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
### Impact
Weak validation of the Apple certificate URL in the Apple Game Center authentication adapter allows to bypass authentication and makes the server vulnerable to DoS attacks.
### Patches
The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
No detection rules found.
No writeups or analysis indexed.
2022-05-04
Published