Patchfirst
Patchfirst
Chainparse-community · parse-servernpm:parse-server

parse-community parse-server: successive fixes (2020–2025)

20 CVEs over 7 generations, 4 Mar 2020 to 21 Mar 2025.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2020-52514 Mar 2020 First in the chain
  2. CVE-2020-1527022 Oct 2020 No direct link to an earlier CVE
  3. CVE-2021-391872 Sep 2021 No direct link to an earlier CVE
  4. CVE-2021-4110930 Sep 2021 related to CVE-2020-15270next fix after CVE-2021-39187
  5. CVE-2022-2476011 Mar 2022 next fix after CVE-2021-41109
  6. CVE-2022-249014 May 2022 next fix after CVE-2022-24760
  7. CVE-2022-3108317 Jun 2022 related to CVE-2022-24901
  8. CVE-2022-3108927 Jun 2022 next fix after CVE-2022-31083
  9. CVE-2022-3111230 Jun 2022 related to CVE-2020-15270related to CVE-2021-41109and 2 more
  10. CVE-2022-360797 Sep 2022 related to CVE-2022-31112related to CVE-2021-39187and 1 more
  11. CVE-2022-3923123 Sep 2022 No direct link to an earlier CVE
  12. CVE-2022-3931324 Oct 2022 related to CVE-2022-31089next fix after CVE-2022-39231
  13. CVE-2022-4187810 Nov 2022 related to CVE-2022-24760
  14. CVE-2022-4187910 Nov 2022 related to CVE-2022-24760related to CVE-2022-31112and 2 more
  15. CVE-2023-224743 Feb 2023 related to CVE-2020-5251related to CVE-2020-15270and 2 more
  16. CVE-2023-3647528 Jun 2023 related to CVE-2022-24760related to CVE-2022-31089and 5 more
  17. CVE-2023-410584 Sep 2023 next fix after CVE-2023-36475related to CVE-2021-39187and 1 more
  18. CVE-2023-4611925 Oct 2023 related to CVE-2022-31089related to CVE-2022-39313and 2 more
  19. CVE-2024-471834 Oct 2024 related to CVE-2023-41058
  20. CVE-2025-3016821 Mar 2025 related to CVE-2024-47183related to CVE-2022-24760and 5 more
202020212022202320242025 CVE-2022-24901 → CVE-2022-31083: related (high confidence)CVE-2022-31112 → CVE-2022-36079: related (high confidence)CVE-2023-36475 → CVE-2023-41058: Next fix in the same package (high confidence)CVE-2024-47183 → CVE-2025-30168: related (high confidence)CVE-2020-5251 → CVE-2023-22474: related (medium confidence)CVE-2020-15270 → CVE-2021-41109: related (medium confidence)CVE-2020-15270 → CVE-2022-31112: related (medium confidence)CVE-2020-15270 → CVE-2023-22474: related (medium confidence)CVE-2021-39187 → CVE-2022-36079: related (medium confidence)CVE-2021-39187 → CVE-2023-41058: related (medium confidence)CVE-2021-41109 → CVE-2022-31112: related (medium confidence)CVE-2022-24760 → CVE-2022-31112: related (medium confidence)CVE-2022-24760 → CVE-2022-36079: related (medium confidence)CVE-2022-24760 → CVE-2022-41878: related (medium confidence)CVE-2022-24760 → CVE-2022-41879: related (medium confidence)CVE-2022-24760 → CVE-2023-22474: related (medium confidence)CVE-2022-24760 → CVE-2023-36475: related (medium confidence)CVE-2022-24760 → CVE-2025-30168: related (medium confidence)CVE-2022-24901 → CVE-2025-30168: related (medium confidence)CVE-2022-31083 → CVE-2025-30168: related (medium confidence)CVE-2022-31089 → CVE-2022-39313: related (medium confidence)CVE-2022-31089 → CVE-2023-36475: related (medium confidence)CVE-2022-31089 → CVE-2023-46119: related (medium confidence)CVE-2022-31112 → CVE-2022-41879: related (medium confidence)CVE-2022-31112 → CVE-2023-36475: related (medium confidence)CVE-2022-36079 → CVE-2022-41879: related (medium confidence)CVE-2022-36079 → CVE-2023-36475: related (medium confidence)CVE-2022-36079 → CVE-2023-41058: related (medium confidence)CVE-2022-39231 → CVE-2025-30168: related (medium confidence)CVE-2022-39313 → CVE-2023-36475: related (medium confidence)CVE-2022-39313 → CVE-2023-46119: related (medium confidence)CVE-2022-41878 → CVE-2022-41879: Next fix in the same package (medium confidence)CVE-2022-41878 → CVE-2023-36475: related (medium confidence)CVE-2022-41879 → CVE-2023-36475: related (medium confidence)CVE-2023-22474 → CVE-2025-30168: related (medium confidence)CVE-2023-36475 → CVE-2023-46119: related (medium confidence)CVE-2023-41058 → CVE-2024-47183: related (medium confidence)CVE-2023-41058 → CVE-2025-30168: related (medium confidence)CVE-2021-39187 → CVE-2021-41109: Next fix in the same package (low confidence)CVE-2021-41109 → CVE-2022-24760: Next fix in the same package (low confidence)CVE-2022-24760 → CVE-2022-24901: Next fix in the same package (low confidence)CVE-2022-31083 → CVE-2022-31089: Next fix in the same package (low confidence)CVE-2022-31089 → CVE-2022-31112: Next fix in the same package (low confidence)CVE-2022-39231 → CVE-2022-39313: Next fix in the same package (low confidence)CVE-2022-41879 → CVE-2023-22474: Next fix in the same package (low confidence)CVE-2023-41058 → CVE-2023-46119: Next fix in the same package (low confidence) CVE-2020-5251 4 Mar 2020 CVE-2020-15270 22 Oct 2020 CVE-2021-39187 2 Sep 2021 CVE-2021-41109 30 Sep 2021 CVE-2022-24760 11 Mar 2022 CVE-2022-24901 4 May 2022 CVE-2022-31083 17 Jun 2022 CVE-2022-31089 27 Jun 2022 CVE-2022-31112 30 Jun 2022 CVE-2022-36079 7 Sep 2022 CVE-2022-39231 23 Sep 2022 CVE-2022-39313 24 Oct 2022 CVE-2022-41878 10 Nov 2022 CVE-2022-41879 10 Nov 2022 CVE-2023-22474 3 Feb 2023 CVE-2023-36475 28 Jun 2023 CVE-2023-41058 4 Sep 2023 CVE-2023-46119 25 Oct 2023 CVE-2024-47183 4 Oct 2024 CVE-2025-30168 21 Mar 2025 202020212022202320242025 CVE-2022-24901 → CVE-2022-31083: related (high confidence)CVE-2022-31112 → CVE-2022-36079: related (high confidence)CVE-2023-36475 → CVE-2023-41058: Next fix in the same package (high confidence)CVE-2024-47183 → CVE-2025-30168: related (high confidence)CVE-2020-5251 → CVE-2023-22474: related (medium confidence)CVE-2020-15270 → CVE-2021-41109: related (medium confidence)CVE-2020-15270 → CVE-2022-31112: related (medium confidence)CVE-2020-15270 → CVE-2023-22474: related (medium confidence)CVE-2021-39187 → CVE-2022-36079: related (medium confidence)CVE-2021-39187 → CVE-2023-41058: related (medium confidence)CVE-2021-41109 → CVE-2022-31112: related (medium confidence)CVE-2022-24760 → CVE-2022-31112: related (medium confidence)CVE-2022-24760 → CVE-2022-36079: related (medium confidence)CVE-2022-24760 → CVE-2022-41878: related (medium confidence)CVE-2022-24760 → CVE-2022-41879: related (medium confidence)CVE-2022-24760 → CVE-2023-22474: related (medium confidence)CVE-2022-24760 → CVE-2023-36475: related (medium confidence)CVE-2022-24760 → CVE-2025-30168: related (medium confidence)CVE-2022-24901 → CVE-2025-30168: related (medium confidence)CVE-2022-31083 → CVE-2025-30168: related (medium confidence)CVE-2022-31089 → CVE-2022-39313: related (medium confidence)CVE-2022-31089 → CVE-2023-36475: related (medium confidence)CVE-2022-31089 → CVE-2023-46119: related (medium confidence)CVE-2022-31112 → CVE-2022-41879: related (medium confidence)CVE-2022-31112 → CVE-2023-36475: related (medium confidence)CVE-2022-36079 → CVE-2022-41879: related (medium confidence)CVE-2022-36079 → CVE-2023-36475: related (medium confidence)CVE-2022-36079 → CVE-2023-41058: related (medium confidence)CVE-2022-39231 → CVE-2025-30168: related (medium confidence)CVE-2022-39313 → CVE-2023-36475: related (medium confidence)CVE-2022-39313 → CVE-2023-46119: related (medium confidence)CVE-2022-41878 → CVE-2022-41879: Next fix in the same package (medium confidence)CVE-2022-41878 → CVE-2023-36475: related (medium confidence)CVE-2022-41879 → CVE-2023-36475: related (medium confidence)CVE-2023-22474 → CVE-2025-30168: related (medium confidence)CVE-2023-36475 → CVE-2023-46119: related (medium confidence)CVE-2023-41058 → CVE-2024-47183: related (medium confidence)CVE-2023-41058 → CVE-2025-30168: related (medium confidence)CVE-2021-39187 → CVE-2021-41109: Next fix in the same package (low confidence)CVE-2021-41109 → CVE-2022-24760: Next fix in the same package (low confidence)CVE-2022-24760 → CVE-2022-24901: Next fix in the same package (low confidence)CVE-2022-31083 → CVE-2022-31089: Next fix in the same package (low confidence)CVE-2022-31089 → CVE-2022-31112: Next fix in the same package (low confidence)CVE-2022-39231 → CVE-2022-39313: Next fix in the same package (low confidence)CVE-2022-41879 → CVE-2023-22474: Next fix in the same package (low confidence)CVE-2023-41058 → CVE-2023-46119: Next fix in the same package (low confidence) CVE-2020-5251 4 Mar 2020 CVE-2020-15270 22 Oct 2020 CVE-2021-39187 2 Sep 2021 CVE-2021-41109 30 Sep 2021 CVE-2022-24760 11 Mar 2022 CVE-2022-24901 4 May 2022 CVE-2022-31083 17 Jun 2022 CVE-2022-31089 27 Jun 2022 CVE-2022-31112 30 Jun 2022 CVE-2022-36079 7 Sep 2022 CVE-2022-39231 23 Sep 2022 CVE-2022-39313 24 Oct 2022 CVE-2022-41878 10 Nov 2022 CVE-2022-41879 10 Nov 2022 CVE-2023-22474 3 Feb 2023 CVE-2023-36475 28 Jun 2023 CVE-2023-41058 4 Sep 2023 CVE-2023-46119 25 Oct 2023 CVE-2024-47183 4 Oct 2024 CVE-2025-30168 21 Mar 2025
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2020-5251 4 Mar 2020 Information disclosure in parse-server · fixed in 4.1.0 First in chain 17.0
CVE-2020-15270 22 Oct 2020 Improper session expiration in Parse Server · fixed in 4.4.0 First in chain 16.5
CVE-2021-39187 2 Sep 2021 Crash server with query parameter · fixed in 4.10.3 First in chain 21.0
CVE-2021-41109 30 Sep 2021 LiveQuery publishes user session tokens · fixed in 4.10.4 CVE-2020-15270 · related · Medium 19.1
CVE-2022-24760 11 Mar 2022 Command Injection in Parse server · fixed in 4.10.7 CVE-2021-41109 · Next fix in the same package · Low 31.8
CVE-2022-24901 4 May 2022 Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter · fixed in 5.2.1 CVE-2022-24760 · Next fix in the same package · Low 15.8
CVE-2022-31083 17 Jun 2022 Authentication bypass in Parse Server Apple Game Center auth adapter · fixed in 5.2.2 CVE-2022-24901 · related · High 17.9
CVE-2022-31089 27 Jun 2022 Invalid file request can crashe parse-server · fixed in 5.2.3 CVE-2022-31083 · Next fix in the same package · Low 18.7
CVE-2022-31112 30 Jun 2022 Protected fields exposed via LiveQuery in parse-server · fixed in 5.2.4 CVE-2020-15270 · related · Medium 20.0
CVE-2022-36079 7 Sep 2022 Parse Server vulnerable to brute force guessing of user sensitive data via search patterns · fixed in 5.2.5 CVE-2022-31112 · related · High 19.9
CVE-2022-39231 23 Sep 2022 Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented · fixed in 5.2.7 First in chain 11.5
CVE-2022-39313 24 Oct 2022 Parse Server crashes when receiving file download request with invalid byte range · fixed in 5.2.8 CVE-2022-31089 · related · Medium 16.6
CVE-2022-41878 10 Nov 2022 Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers · fixed in 5.3.2 CVE-2022-24760 · related · Medium 17.3
CVE-2022-41879 10 Nov 2022 Parse Server subject to Prototype pollution via Cloud Code Webhooks · fixed in 5.3.3 CVE-2022-24760 · related · Medium 16.9
CVE-2023-22474 3 Feb 2023 Parse Server is vulnerable to authentication bypass via spoofing · fixed in 5.4.1 CVE-2020-5251 · related · Medium 16.4
CVE-2023-36475 28 Jun 2023 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution · fixed in 6.2.1 CVE-2022-24760 · related · Medium 24.5
CVE-2023-41058 4 Sep 2023 Trigger `beforeFind` not invoked in internal query pipeline in parse-server · fixed in 6.2.2 CVE-2023-36475 · Next fix in the same package · High 16.4
CVE-2023-46119 25 Oct 2023 Parse Server may crash when uploading file without extension · fixed in 6.3.1 CVE-2022-31089 · related · Medium 19.4
CVE-2024-47183 4 Oct 2024 Parse Server's custom object ID allows to acquire role privileges · fixed in 7.3.0 CVE-2023-41058 · related · Medium 12.9
CVE-2025-30168 21 Mar 2025 Parse Server has an OAuth login vulnerability · fixed in 8.0.2 CVE-2024-47183 · related · High 11.8
↑ ↓ chooseEnter openEsc close