{"action":"Upgrade parse-server to 4.10.15 or later.","affected":[{"fixed":"4.10.15","introduced":"0"},{"fixed":"5.2.6","introduced":"5.0.0"}],"component":"parse-server","cve_ids":["CVE-2022-39225"],"ecosystem":"npm","epss":0.00488,"exploited":false,"fixed_versions":["4.10.15","5.2.6"],"ghsa_id":"GHSA-6w4q-23cf-j9jp","id":"tcs_01M5KF83M9P7CPJH9G49VWMK7S","modified_at":"2023-12-06T01:02:32.744748Z","published_at":"2022-09-21T18:32:01Z","references":["https://osv.dev/vulnerability/GHSA-6w4q-23cf-j9jp","https://github.com/parse-community/parse-server/security/advisories/GHSA-6w4q-23cf-j9jp","https://nvd.nist.gov/vuln/detail/CVE-2022-39225","https://github.com/parse-community/parse-server/commit/37fed3062ccc3ef1dfd49a9fc53318e72b3e4aff","https://github.com/parse-community/parse-server","https://github.com/parse-community/parse-server/releases/tag/4.10.15","https://github.com/parse-community/parse-server/releases/tag/5.2.6"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-6w4q-23cf-j9jp","url":"https://osv.dev/vulnerability/GHSA-6w4q-23cf-j9jp"}],"summary":"parse-server's session object properties can be updated by foreign user if object ID is known"}