npm/parse-server CVE-2021-39138: medium 4.8, EPSS 0.99%
parse-server new anonymous user session acts as if it's created with password
Action: Upgrade parse-server to 4.5.2 or later.
npm i parse-server@4.5.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.5.2 | - |
Fixed versions
| 4.5.2 |
Sources
- osv: GHSA-23r4-5mxp-c7g5
- https://github.com/parse-community/parse-server/security/advisories/GHSA-23r4-5mxp-c7g5
- https://nvd.nist.gov/vuln/detail/CVE-2021-39138
- https://github.com/parse-community/parse-server/commit/147bd9a3dc43391e92c36e05d5db860b04ca27db
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/releases/tag/4.5.2
CVE-2021-39138 · published · modified · JSON