CVE-2024-39309
Critical · 9.8CVSS
9.8
EPSS
20.2%
Published
Jul 1, 2024
CISA due date
—
The record
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | parse-server | 0 | 6.5.7 |
| npm | parse-server | 7.0.0 | 7.1.0 |
| Bitnami | parse | 0 | 6.5.7 |
| Bitnami | parse | 0 | 7.2.0 |
Related vulnerabilities
- GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access… Also affects parse-server
- GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL Also affects parse-server
- GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension… Also affects parse-server
- GHSA-p84r-h6rx-f2xr parse-server: Server option routeAllowList is bypassable through batch sub-requests Also affects parse-server
- GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query… Also affects parse-server
- CVE-2026-53726 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse-server
- CVE-2026-53724 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse-server
- CVE-2026-50008 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse-server