CVE-2022-31112 json
Protected fields exposed via LiveQuery in parse-server
published 2022-06-30 4 y ago modified 2026-09-08 2 mo ago also BIT-parse-2022-31112 , EUVD-2022-6325 , GHSA-crrq-vr9j-fxxh
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
Patch / fix
- npm parse-server 4.10.13, 5.2.4
- bitnami parse 4.10.13, 5.2.4
- parseplatform parse-server 4.10.13, 5.2.4
- github.com/parse-community/parse-server@309f64c commit
- github.com/parse-community/parse-server@9fd4516 commit
- github.com/parse-community/parse-server@054f3e6 commit
- github.com/parse-community/parse-server#8074 pull request
- github.com/parse-community/parse-server/releases/tag/5.2.4 release
- github.com/parse-community/parse-server/issues/8073 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
1.34% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| OSV | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | parse-server | <4.10.13 >=5.0.0, <5.2.4 |
4.10.13 5.2.4 |
| bitnami | parse | <4.10.13 >=5.0.0, <5.2.4 |
4.10.13 5.2.4 |
Affected products
- parse-community parse-server
Classification
References
-
github.com
/parse-community/parse-server/pull/8074
web, patch, release-notes, third-party-advisory, advisory
-
github.com
/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1
web, patch, third-party-advisory, advisory
-
github.com
/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6
web, patch, third-party-advisory, advisory
-
github.com
/parse-community/parse-server/issues/8073
web, issue-tracking, patch, release-notes, third-party-advisory, advisory
-
github.com
/parse-community/parse-server/commit/054f3e6ab01d66a0dcfb77725af28eac1485b375
web
-
github.com
/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
web, third-party-advisory, advisory
-
github.com
/parse-community/parse-server/releases/tag/5.2.4
web, release-notes, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-31112
advisory, web
-
github.com
/parse-community/parse-server
package
Sources
- CVE List CVE-2022-31112
- GitHub Advisory GHSA-crrq-vr9j-fxxh
- NVD CVE-2022-31112
- OSV BIT-parse-2022-31112
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.