CVE-2022-41878

Description

### Impact Keywords that are specified in the Parse Server option `requestKeywordDenylist` can be injected via Cloud Code Webhooks or Triggers. This will result in the keyword being saved to the database, bypassing the `requestKeywordDenylist` option. ### Patches Improved keyword detection. ### Workarounds Configure your firewall to only allow trusted servers to make request to the Parse Server Cloud Code Webhooks API, or block the API completely if you are not using the feature. ### Collaborators Mikhail Shcherbakov, Cristian-Alexandru Staicu and Musard Balliu working with Trend Micro Zero Day Initiative ### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-xprv-wvh7-qqqx

How to fix CVE-2022-41878

To remediate CVE-2022-41878, upgrade the affected package to a fixed version below.

• —upgrade to 4.10.19 or later
• —upgrade to 4.10.19 or later

Is CVE-2022-41878 being exploited?

Low — EPSS is 0.5%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 4.10.19, >= 5.0.0, < 5.3.2
• from 0, < 4.10.19

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-41878
• PATCHgithub.com/parse-community/parse-server
• WEBgithub.com/parse-community/parse-server/commit/0a2d412e265992d53a670011afd9d2578562adc3
• WEBgithub.com/parse-community/parse-server/commit/6728da1e3591db1e27031d335d64d8f25546a06f