{"id":"CVE-2022-36079","published":"2022-09-07T20:40:13Z","modified":"2025-04-23T17:13:55Z","title":"Parse Server vulnerable to brute force guessing of user sensitive data via search patterns","vendor":"parse-community","product":"parse-server","tier":"tail","description":{"text":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01256,"percentile":0.69524,"provenance":"source"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-2m6g-crv8-p3c6","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/parse-community/parse-server/issues/8143","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/issues/8144","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89a2b602d92799bec","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/commit/e39d51bd329cd978589983bd659db46e1d45aad4","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/4.10.14","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/5.2.5","tags":["x_refsource_MISC"]}],"priority":{"score":19.9,"factors":[{"name":"EPSS percentile","points":13.9},{"name":"CVSS severity","points":6.02}]},"vendorSlug":"parse-community","affectedVersions":[{"vendor":"parse-community","product":"parse-server","versions":["< 4.10.14",">= 5.0.0, < 5.2.5"]}],"affected":[{"ecosystem":"npm","package":"parse-server","vulnerableRanges":["<4.10.14",">=5.0.0, <5.2.5"],"patched":["4.10.14","5.2.5"],"from":["GHSA-2m6g-crv8-p3c6"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-6666","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2022-31083","published":"2022-06-17","fixed":"5.2.2","kev":false},{"cve":"CVE-2022-31089","published":"2022-06-27","fixed":"5.2.3","kev":false},{"cve":"CVE-2022-31112","published":"2022-06-30","fixed":"5.2.4","kev":false,"link":{"from":"CVE-2022-31112","to":"CVE-2022-36079","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"4.10.13","toFixed":"4.10.14","daysApart":69},{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"5.2.4","toFixed":"5.2.5","daysApart":69}]}},{"cve":"CVE-2022-36079","published":"2022-09-07","fixed":"5.2.5","kev":false},{"cve":"CVE-2022-39225","published":"2022-09-23","fixed":"5.2.6","kev":false,"link":{"from":"CVE-2022-36079","to":"CVE-2022-39225","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"4.10.14","toFixed":"4.10.15","daysApart":16},{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"5.2.5","toFixed":"5.2.6","daysApart":16}]}},{"cve":"CVE-2022-39231","published":"2022-09-23","fixed":"5.2.7","kev":false},{"cve":"CVE-2022-39313","published":"2022-10-24","fixed":"5.2.8","kev":false}],"package":"npm:parse-server"}}