CVE-2022-31112 HIGH

CVE-2022-31112: Protected fields exposed via LiveQuery in parse-server

Vendor Parse-Community
Product parse-server
Weakness CWE-200 · Info exposure
Published June 30, 2022
Last update April 23, 2025
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.

Key dates

02Disclosure timeline

June 30, 2022 CVE published
April 23, 2025 Record updated