TI-2022-16502 Aliases CVE-2022-36079 GHSA-2m6g-crv8-p3c6

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

MEDIUM 46CWE-200Published 2022-09-07 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Internal fields (keys used internally by Parse Server, prefixed by `_`) and protected fields (user defined) can be used as query constraints. Internal and protected fields are removed by Parse Server and are only returned to the client using a valid master key. However, using query constraints, these fields can be guessed by enumerating until Parse Server, prior to versions 4.10.14 or 5.2.5, returns a response object. The patch available in versions 4.10.14 and 5.2.5 requires the maser key to use internal and protected fields as query constraints. As a workaround, implement a Parse Cloud Trigger `beforeFind` and manually remove the query constraints.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01283 70th percentileScored 2026-11-07

Fix Fixed parse-server (parse-community): 4.10.14, 5.2.5parse-server (npm): 4.10.14, 5.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
parse-community	parse-server	before 4.10.14; 5.0.0 to before 5.2.5	4.10.14, 5.2.5	Patch available	CNA
—	parse-server (npm)	before 4.10.14	4.10.14	Patch available	GHSA-2m6g-crv8-p3c6
—	parse-server (npm)	5.0.0 to before 5.2.5	5.2.5	Patch available	GHSA-2m6g-crv8-p3c6

parse-server Vendorparse-community Affected before 4.10.14; 5.0.0 to before 5.2.5 Fixed in 4.10.14, 5.2.5 Patch available CNA
parse-server (npm) Vendor— Affected before 4.10.14 Fixed in 4.10.14 Patch available GHSA-2m6g-crv8-p3c6
parse-server (npm) Vendor— Affected 5.0.0 to before 5.2.5 Fixed in 5.2.5 Patch available GHSA-2m6g-crv8-p3c6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:parseplatform:parse-server::::::node.js::*	before 4.10.14; 5.0.0 to before 5.2.5	Vulnerable	parse-community

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* Versions before 4.10.14; 5.0.0 to before 5.2.5 Vulnerable ·parse-community

Remediation

Fix · CNA parse-server (parse-community) Fixed in 4.10.14, 5.2.5
Fix · GHSA-2m6g-crv8-p3c6 parse-server (npm) Fixed in 4.10.14 Advisory →
Fix · GHSA-2m6g-crv8-p3c6 parse-server (npm) Fixed in 5.2.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-36079
2026-10-03 Alias added: GHSA-2m6g-crv8-p3c6

References

Patch 2

Advisory 6

Other 1

https://github.com/parse-community/parse-server

TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
TI-2023-18316 Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution CVSS 3.1CRITICAL 9.8
TI-2026-23790 Parse Server session token exfiltration via `redirectClassNameForKey` query parameter CVSS 4.0CRITICAL 9.9

See all 101 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences