CVE-2022-24760

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-1321

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-247617.5Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does CVE-2022-247626.5sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin comm CVE-2022-247637.5PJSIP is a free and open source multimedia communication library written in the C language. Versions 2.12 and prior contain a denial-of-serv CVE-2022-247647.5PJSIP is a free and open source multimedia communication library written in C. Versions 2.12 and prior contain a stack buffer overflow vulne CVE-2022-247657.8Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where CVE-2022-247669.8mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perfo CVE-2022-247677.8GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.CVE-2022-247688.8Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All unpatched versions of Argo CD starting with 1.0.0 are vulnerab CVE-2022-247695.9Moby is an open-source project created by Docker to enable and accelerate software containerization. A bug was found in Moby (Docker Engine)CVE-2022-24778.8Use after free in Guest View in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extens CVE-2022-247708.8`gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers f CVE-2022-247717.5Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1