Parse Server before v3.4.1 vulnerable to Denial of Service
High severity
GitHub Reviewed
Published
Jun 12, 2019
in
parse-community/parse-server
•
Updated Jan 8, 2023
Description
Published to the GitHub Advisory Database
Jun 13, 2019
Reviewed
Jun 16, 2020
Last updated
Jan 8, 2023
Impact
If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).
Patches
Afflicted installations will also have to remove the offending collection from their database.
Yes, patched in 3.4.1
Workarounds
Yes, user can apply: parse-community/parse-server@8709daf
References
Nothing other than this advisory at this time
For more information
If you have any questions or comments about this advisory:
References