CVE-2024-29027

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

arse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 6.5.5 and 7.0.0-alpha.29, calling an invalid Parse Server Cloud Function name or Cloud Job name crashes the server and may allow for code injection, internal store manipulation or remote code execution. The patch in versions 6.5.5 and 7.0.0-alpha.29 added string sanitation for Cloud Function name and Cloud Job name. As a workaround, sanitize the Cloud Function name and Cloud Job name before it reaches Parse Server.

References

Link	Resource
https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b	Patch
https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e	Patch
https://github.com/parse-community/parse-server/releases/tag/6.5.5	Release Notes
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29	Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29	Vendor Advisory
https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b	Patch
https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e	Patch
https://github.com/parse-community/parse-server/releases/tag/6.5.5	Release Notes
https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29	Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:parseplatform:parse-server::::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha1::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha10::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha11::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha12::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha13::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha14::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha15::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha16::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha17::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha18::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha19::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha2::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha20::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha21::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha22::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha23::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha24::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha25::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha26::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha27::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha28::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha3::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha4::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha5::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha6::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha7::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha8::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha9::::node.js::*

History

17 Dec 2025, 21:33

Type	Values Removed	Values Added
References	~~() https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b -~~	() https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b - Patch
References	~~() https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e -~~	() https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e - Patch
References	~~() https://github.com/parse-community/parse-server/releases/tag/6.5.5 -~~	() https://github.com/parse-community/parse-server/releases/tag/6.5.5 - Release Notes
References	~~() https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 -~~	() https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 - Release Notes
References	~~() https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 -~~	() https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 - Vendor Advisory
CPE		cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha28::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha16::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha21::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha1::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha13::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha17::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha6::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha26::::node.js::* cpe:2.3:a:parseplatform:parse-server::::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha12::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha18::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha10::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha23::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha11::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha3::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha5::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha14::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha8::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha19::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha25::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha9::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha15::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha22::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha20::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha4::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha27::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha2::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha7::::node.js::* cpe:2.3:a:parseplatform:parse-server:7.0.0:alpha24::::node.js::*
First Time		Parseplatform parse-server Parseplatform

21 Nov 2024, 09:07

Type	Values Removed	Values Added
References	~~() https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b -~~	() https://github.com/parse-community/parse-server/commit/5ae6d6a36d75c4511029f0ba5673ae4b2999179b -
References	~~() https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e -~~	() https://github.com/parse-community/parse-server/commit/9f6e3429d3b326cf4e2994733c618d08032fac6e -
References	~~() https://github.com/parse-community/parse-server/releases/tag/6.5.5 -~~	() https://github.com/parse-community/parse-server/releases/tag/6.5.5 -
References	~~() https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 -~~	() https://github.com/parse-community/parse-server/releases/tag/7.0.0-alpha.29 -
References	~~() https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 -~~	() https://github.com/parse-community/parse-server/security/advisories/GHSA-6hh7-46r2-vf29 -

Information

Published : 2024-03-19 19:15

Updated : 2025-12-17 21:33

NVD link : CVE-2024-29027

Mitre link : CVE-2024-29027

CVE.ORG link : CVE-2024-29027

JSON object : View

Products Affected

parseplatform

parse-server

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

9.0 /10