CVE-2022-31112
published 2022-06-30CVE-2022-31112: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not…
PriorityP344high8.2CVSS 3.1
AVNACLPRNUINSUCHILAN
EPSS
1.21%
64.6th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 4.10.13 | 4.10.13 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 4.10.13 | 4.10.13 |
| parse-community | parse-server | >= 5.0.0 < 5.2.4 | 5.2.4 |
| parseplatform | parse-server | < 4.10.13 | 4.10.13 |
| parseplatform | parse-server | >= 5.0.0 < 5.2.4 | 5.2.4 |
CVSS provenance
nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Protected fields exposed via LiveQuery
ghsa·2022-07-06
CVE-2022-31112 [HIGH] CWE-200 Protected fields exposed via LiveQuery
Protected fields exposed via LiveQuery
### Impact
Parse Server LiveQuery does not remove protected fields in classes, passing them to the client.
### Patches
The LiveQueryController now removes protected fields from the client response.
### Workarounds
Use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
- https://github.com/parse-community/parse-server
### For more information
If you have any questions or comments about this advisory:
- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)
- Report other vulnerabilities at [report.parseplatform.o
OSV
Protected fields exposed via LiveQuery
osv·2022-07-06
CVE-2022-31112 [HIGH] Protected fields exposed via LiveQuery
Protected fields exposed via LiveQuery
### Impact
Parse Server LiveQuery does not remove protected fields in classes, passing them to the client.
### Patches
The LiveQueryController now removes protected fields from the client response.
### Workarounds
Use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
- https://github.com/parse-community/parse-server
### For more information
If you have any questions or comments about this advisory:
- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)
- Report other vulnerabilities at [report.parseplatform.o
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6https://github.com/parse-community/parse-server/issues/8073https://github.com/parse-community/parse-server/pull/8074https://github.com/parse-community/parse-server/releases/tag/5.2.4https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxhhttps://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6https://github.com/parse-community/parse-server/issues/8073https://github.com/parse-community/parse-server/pull/8074https://github.com/parse-community/parse-server/releases/tag/5.2.4https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
2022-06-30
Published