VULNERABILITY INTELLIGENCE
CVE-2022-31112
CVSS score8.2 HIGH
EPSS probability1.34%
CISA KEVNot currently listed
Published2022-06-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.
Weakness classification
- security-advisories@github.com: CWE-200
- nvd@nist.gov: CWE-212
Primary references
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Patch, Third Party Advisory
- security-advisories@github.com — Issue Tracking, Patch, Release Notes, Third Party Advisory
- security-advisories@github.com — Patch, Release Notes, Third Party Advisory
- security-advisories@github.com — Release Notes, Third Party Advisory
- security-advisories@github.com — Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch, Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory