GCVE - cpe:2.3:a:parseplatform:parse_server:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:parseplatform:parse_server:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Parseplatform (`6383af77-895d-54d6-99f0-fd04347d92e2`)
Product	Parse Server (`5d091d53-4830-5a26-bf49-71cbc7e60404`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/parse-community/parse-server`	purl2cpe	2026-06-01 10:16:40.160472
`pkg:npm/parse-server`	purl2cpe	2026-06-01 10:16:40.160474

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-47183`	vulnerable	2026-06-08 06:48:11.554748	Parse Server's custom object ID allows to acquire role privileges HIGH (8.1) Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. If the Parse Server option allowCustomObjectId: true is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role. This vulnerability is fixed in 6.5.9 and 7.3.0. Published: 2024-10-04T15:06:45.274Z Updated: 2024-10-04T15:30:37.224Z Open on db.gcve.eu Reference links https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg https://github.com/parse-community/parse-server/pull/9317 https://github.com/parse-community/parse-server/pull/9318 https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-22474`	vulnerable	2026-06-08 05:54:26.394595	Parse Server is vulnerable to authentication bypass via spoofing HIGH (8.7) Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`. Published: 2023-02-03T19:57:09.413Z Updated: 2024-08-02T10:13:48.475Z Open on db.gcve.eu Reference links https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15126`	vulnerable	2026-06-08 05:19:25.322044	Information disclosure through Viewer query in parse-server MEDIUM (6.5) In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object. Published: 2020-07-22T23:05:19.000Z Updated: 2024-08-04T13:08:22.292Z Open on db.gcve.eu Reference links https://github.com/parse-community/parse-server/security/advisories/GHSA-236h-rqv8-8q73 https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa https://github.com/parse-community/parse-server/blob/master/CHANGELOG.md#430	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.