Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0-alpha.9, when multiple clients subscribe to the same class v…
Medium CVSS 5.3
Summary
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0-alpha.9, when multiple clients subscribe to the same class via LiveQuery, the event handlers process each subscriber concurrently using shared mutable objects. The sensitive data filter modifies these shared objects in-place, so when one subscriber's filter removes a protected field, subsequent subscribers may receive the already-filtered object. This can ca…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://github.com/parse-community/parse-server/commit/5834e29234593addaa0251a85f572ad4f376320b Patch
- https://github.com/parse-community/parse-server/commit/776c71c3078e77d38c94937f463741793609d055 Patch
- https://github.com/parse-community/parse-server/pull/10330 Issue Tracking
- https://github.com/parse-community/parse-server/pull/10331 Issue Tracking
- https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65 Patch
Timeline
- nvd_ingest NVD