{"id":"CVE-2024-47183","published":"2024-10-04T15:06:45Z","modified":"2024-10-04T15:30:37Z","title":"Parse Server's custom object ID allows to acquire role privileges","vendor":"parse-community","product":"parse-server","tier":"tail","description":{"text":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00416,"percentile":0.35942,"provenance":"source"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/parse-community/parse-server/pull/9317","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/pull/9318","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc","tags":["x_refsource_MISC"]},{"url":"https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f","tags":["x_refsource_MISC"]}],"priority":{"score":12.9,"factors":[{"name":"EPSS percentile","points":7.19},{"name":"CVSS severity","points":5.67}]},"vendorSlug":"parse-community","affectedVersions":[{"vendor":"parse-community","product":"parse-server","versions":["< 6.5.9",">= 7.0.0, < 7.3.0"]}],"affected":[{"ecosystem":"npm","package":"parse-server","vulnerableRanges":["<6.5.9",">=7.0.0, <7.3.0"],"patched":["6.5.9","7.3.0"],"from":["GHSA-8xq9-g7ch-35hg"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3001","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-parse-community-parse-server-cve-2020-5251","parents":[{"from":"CVE-2023-41058","to":"CVE-2024-47183","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Auth.js"],"commits":["https://github.com/parse-community/parse-server/commit/be4c7e23c63a2fb690685665cebed0de26be05c5","https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc","https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2024-47183","to":"CVE-2025-30168","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"7.3.0","toFixed":"7.5.2","daysApart":168},{"kind":"same-code","provenance":"machine","files":["src/Auth.js"],"commits":["https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc","https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f","https://github.com/parse-community/parse-server/commit/5ef0440c8e763854e62341acaeb6dc4ade3ba82f","https://github.com/parse-community/parse-server/commit/2ff9c71030bce3aada0a00fbceedeb7ae2c8a41e"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2024-27298","published":"2024-03-01","fixed":"7.0.0-alpha.20","kev":false},{"cve":"CVE-2024-29027","published":"2024-03-19","fixed":"7.0.0-alpha.29","kev":false},{"cve":"CVE-2024-39309","published":"2024-07-01","fixed":"7.1.0","kev":false,"link":{"from":"CVE-2024-39309","to":"CVE-2024-47183","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"6.5.7","toFixed":"6.5.9","daysApart":95},{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"7.1.0","toFixed":"7.3.0","daysApart":95}]}},{"cve":"CVE-2024-47183","published":"2024-10-04","fixed":"7.3.0","kev":false},{"cve":"CVE-2025-30168","published":"2025-03-21","fixed":"8.0.2","kev":false},{"cve":"CVE-2025-53364","published":"2025-07-10","fixed":"8.2.2","kev":false},{"cve":"CVE-2025-64430","published":"2025-11-07","fixed":"8.4.0-alpha.2","kev":false}],"package":"npm:parse-server"}}