npm/parse-server CVE-2021-47986, CVE-2021-47987: high 7.5, EPSS 0.18%
Incorrect version tags linked to external repository
Action: Upgrade parse-server to 4.5.2 (4.5.x) or 4.10.0 (4.10.x) or later.
npm i parse-server@4.5.2npm i parse-server@4.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.5.2 | - |
| 4.6.0 | 4.10.0 | - |
Fixed versions
| 4.5.2 | 4.10.0 |
Sources
- osv: GHSA-593v-wcqx-hq2w
- https://github.com/parse-community/parse-server/security/advisories/GHSA-593v-wcqx-hq2w
- https://github.com/parse-community/parse-server
- https://nvd.nist.gov/vuln/detail/CVE-2021-47986
- https://nvd.nist.gov/vuln/detail/CVE-2021-47987
- https://www.vulncheck.com/advisories/parse-server-arbitrary-code-execution-via-malicious-version-tags
- https://www.vulncheck.com/advisories/parse-server-unreviewed-code-execution-via-malicious-version-tags
CVE-2021-47986, CVE-2021-47987 · published · modified · JSON