CVE-2024-29027

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29027
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.

9.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b Patch
https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e Patch
https://github.com/parse-community/parse-server/releases/tag/6.5.5 Release Notes
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 Vendor Advisory
https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b Patch
https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e Patch
https://github.com/parse-community/parse-server/releases/tag/6.5.5 Release Notes
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha10:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha11:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha12:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha13:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha14:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha15:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha16:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha17:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha18:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha19:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha2:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha20:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha21:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha22:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha23:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha24:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha25:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha26:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha27:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha28:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha3:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha4:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha5:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha6:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha7:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha8:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha9:*:*:*:node.js:*:*
History

17 Dec 2025, 21:33

Type Values Removed Values Added
References () https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b - () https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b - Patch
References () https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e - () https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e - Patch
References () https://github.com/parse-community/parse-server/releases/tag/6.5.5 - () https://github.com/parse-community/parse-server/releases/tag/6.5.5 - Release Notes
References () https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 - () https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 - Release Notes
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 - () https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 - Vendor Advisory
CPE cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha3:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha12:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha16:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha18:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha6:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha24:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha14:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha25:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha7:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha26:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha22:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha8:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha5:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha15:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha17:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha10:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha4:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha13:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha27:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha28:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha19:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha23:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha9:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha11:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha2:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha21:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha20:*:*:*:node.js:*:*
First Time Parseplatform
Parseplatform parse-server

21 Nov 2024, 09:07

Type Values Removed Values Added
References () https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b - () https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b -
References () https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e - () https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e -
References () https://github.com/parse-community/parse-server/releases/tag/6.5.5 - () https://github.com/parse-community/parse-server/releases/tag/6.5.5 -
References () https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 - () https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 -
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 - () https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 -

19 Mar 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-03-19 19:15

Updated : 2025-12-17 21:33

NVD link : CVE-2024-29027

Mitre link : CVE-2024-29027

CVE.ORG link : CVE-2024-29027

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')