CVE-2023-36475 CRITICAL

CVE-2023-36475: Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

Vendor Parse-Community
Product parse-server
Weakness CWE-1321
Published June 28, 2023
Last update November 27, 2024
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.

Key dates

02Disclosure timeline

June 28, 2023 CVE published
November 27, 2024 Record updated