CVE-2023-36475

Description

### Impact An attacker can use this prototype pollution sink to trigger a remote code execution through the MongoDB BSON parser. ### Patches Prevent prototype pollution in MongoDB database adapter. ### Workarounds Disable remote code execution through the MongoDB BSON parser. ### Credits - Discovered by hir0ot working with Trend Micro Zero Day Initiative - Fixed by dbythy - Reviewed by mtrezza ### References - https://github.com/parse-community/parse-server/security/advisories/GHSA-462x-c3jw-7vr6 - https://github.com/advisories/GHSA-prm5-8g2m-24gg

How to fix CVE-2023-36475

To remediate CVE-2023-36475, upgrade the affected package to a fixed version below.

• —upgrade to 5.5.2 or later
• —upgrade to 5.5.2 or later

Is CVE-2023-36475 being exploited?

Moderate — EPSS is 9.8%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (2)

• from 0, < 5.5.2, >= 6.0.0, < 6.2.1
• from 0, < 5.5.2

CVSS scores

References (9)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-36475
• PATCHgithub.com/parse-community/parse-server
• WEBgithub.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90
• WEBgithub.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f