CVE-2022-31112

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-200 CWE-212

Affected software

Vendor	Product	Versions
parse-community	parse-server	< 4.10.13; >= 5.0.0, < 5.2.4

References

https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1Patch, Third Party Advisory
https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6Patch, Third Party Advisory
https://github.com/parse-community/parse-server/issues/8073Issue Tracking, Patch, Release Notes, Third Party Advisory
https://github.com/parse-community/parse-server/pull/8074Patch, Release Notes, Third Party Advisory
https://github.com/parse-community/parse-server/releases/tag/5.2.4Release Notes, Third Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxhThird Party Advisory
https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1Patch, Third Party Advisory
https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6Patch, Third Party Advisory
https://github.com/parse-community/parse-server/issues/8073Issue Tracking, Patch, Release Notes, Third Party Advisory
https://github.com/parse-community/parse-server/pull/8074Patch, Release Notes, Third Party Advisory
https://github.com/parse-community/parse-server/releases/tag/5.2.4Release Notes, Third Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxhThird Party Advisory

Timeline

Published: Jun 30, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-311136.1Canarytokens is an open source tool which helps track activity and actions on your network. A Cross-Site Scripting vulnerability was identif CVE-2022-311145.1backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build c CVE-2022-311158.8opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby. In versions prior to 2.0.1 the ruby `YAML.load` function was CVE-2022-311167.5UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Affected versions were found to improperly dec CVE-2022-311175.9UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. In versions prior to 5.4.0 an error occurring CVE-2022-311185.3Nextcloud server is an open source personal cloud solution. In affected versions an attacker could brute force to find if federated sharing CVE-2022-311194.9Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user password CVE-2022-31125.5An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks c CVE-2022-311202.7Nextcloud server is an open source personal cloud solution. The audit log is used to get a full trail of the actions which has been incomple CVE-2022-311217.5Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus re CVE-2022-311228.1Wire is an encrypted communication and collaboration platform. Versions prior to 2022-07-12/Chart 4.19.0 are subject to Token Recipient Conf CVE-2022-311237.8Grafana is an open source observability and data visualization platform. Versions prior to 9.1.8 and 8.5.14 are vulnerable to a bypass in th