A critical SQL injection vulnerability, identified as CVE-2024-27298, posed a significant threat to parse-server, particularly when configured with PostgreSQL. The flaw allowed attackers to manipulate SQL commands, potentially leading to unauthorized access or data compromise. GitHub, Inc. promptly addressed this issue, releasing fixes in versions 6.5.0 and 7.0.0-alpha.20. Users are strongly advised to update to these secure releases to mitigate the risk.
The exploit prediction scoring system (EPSS) assigns a low probability of exploitation activity in the next 30 days, standing at 0.05%. This low likelihood is reassuring, and the CVSS Base Score of 10.0 classifies the vulnerability as critical. The severity stems from the potential compromise of confidentiality, integrity, and availability. The Common Vulnerabilities and Exposures (CVE) identifiers CWE-89, emphasizing improper neutralization of special elements in SQL commands, highlight the nature of the vulnerability.
For detailed information and fixes, users can refer to GitHub’s official release pages for version 6.5.0 here and version 7.0.0-alpha.20 here. Additionally, references and advisories are available here and here.
Reference:
