SQL Injection Vulnerability Affects Parse Server Prior to 6.5.7 and 7.1.0
CVE-2024-39309
9.8CRITICAL
What is CVE-2024-39309?
A vulnerability exists in Parse Server that potentially exposes it to SQL injection attacks when configured with the PostgreSQL database. This issue is present in versions prior to 6.5.7 and 7.1.0. The vulnerability stems from deficiencies in the code that validates SQL commands, allowing unauthorized access to the database. Subsequent releases have incorporated improved algorithms to detect and mitigate SQL injection risks, significantly enhancing the security posture of users operating on the affected versions. It is crucial for users of Parse Server to upgrade to the patched versions to safeguard against potential exploitation.
Affected Version(s)
parse-server < 6.5.7 < 6.5.7
parse-server >= 7.0.0, < 7.1.0 < 7.0.0, 7.1.0