CVE Catalog
CVE-2023-36475
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk2.68%
84th percentile - higher than 84% of all known CVEs
Summary
Parse Server prior to versions 5.5.2 and 6.2.1 is vulnerable to prototype pollution, which can lead to remote code execution through the MongoDB BSON parser.
Risk Assessment
An attacker can exploit this vulnerability to execute malicious code on the server, potentially leading to data loss or system takeover.
Recommendation
It is recommended to upgrade to versions 5.5.2 or 6.2.1 to mitigate this vulnerability.
Original NVD description (English source)
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 5.5.2 and 6.2.1, an attacker can use a prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. A patch is available in versions 5.5.2 and 6.2.1.