{"id":"CVE-2023-46119","published":"2023-10-25T00:03:55Z","modified":"2024-09-10T15:56:13Z","title":"Parse Server may crash when uploading file without extension","vendor":"parse-community","product":"parse-server","tier":"tail","description":{"text":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.\n\n","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01316,"percentile":0.70727,"provenance":"source"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/5.5.6","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/6.3.1","tags":["x_refsource_MISC"]}],"priority":{"score":19.4,"factors":[{"name":"EPSS percentile","points":14.15},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"parse-community","affectedVersions":[{"vendor":"parse-community","product":"parse-server","versions":[">= 1.0.0, < 5.5.6",">= 6.0.0, < 6.3.1"]}],"affected":[{"ecosystem":"npm","package":"parse-server","vulnerableRanges":[">=1.0.0, <5.5.6",">=6.0.0, <6.3.1"],"patched":["5.5.6","6.3.1"],"from":["GHSA-792q-q67h-w579"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-2684","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-parse-community-parse-server-cve-2020-5251","parents":[{"from":"CVE-2022-31089","to":"CVE-2023-46119","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Routers/FilesRouter.js"],"commits":["https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92","https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe","https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0"],"basis":"shared function","functions":["FilesRouter"]}]},{"from":"CVE-2022-39313","to":"CVE-2023-46119","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Routers/FilesRouter.js"],"commits":["https://github.com/parse-community/parse-server/commit/066f29673ab4030b6b5b90c0c0326f7d3fe7612a","https://github.com/parse-community/parse-server/commit/3d7a61ecd5231638f01ff1a965b6313043c594a7","https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe","https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0"],"basis":"shared function","functions":["FilesRouter"]}]},{"from":"CVE-2023-36475","to":"CVE-2023-46119","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Routers/FilesRouter.js"],"commits":["https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90","https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f","https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe","https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0"],"basis":"shared function","functions":["FilesRouter"]}]}],"packageHistory":[{"cve":"CVE-2023-32689","published":"2023-05-30","fixed":"6.1.1","kev":false},{"cve":"CVE-2023-36475","published":"2023-06-28","fixed":"6.2.1","kev":false},{"cve":"CVE-2023-41058","published":"2023-09-04","fixed":"6.2.2","kev":false,"link":{"from":"CVE-2023-41058","to":"CVE-2023-46119","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"5.5.5","toFixed":"5.5.6","daysApart":51},{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"6.2.2","toFixed":"6.3.1","daysApart":51}]}},{"cve":"CVE-2023-46119","published":"2023-10-25","fixed":"6.3.1","kev":false},{"cve":"CVE-2024-27298","published":"2024-03-01","fixed":"7.0.0-alpha.20","kev":false,"link":{"from":"CVE-2023-46119","to":"CVE-2024-27298","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"6.3.1","toFixed":"6.5.0","daysApart":128}]}},{"cve":"CVE-2024-29027","published":"2024-03-19","fixed":"7.0.0-alpha.29","kev":false},{"cve":"CVE-2024-39309","published":"2024-07-01","fixed":"7.1.0","kev":false}],"package":"npm:parse-server"}}