{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-28T14:21:55.676","vulnerabilities":[{"cve":{"id":"CVE-2022-31112","sourceIdentifier":"security-advisories@github.com","published":"2022-06-30T17:15:07.977","lastModified":"2026-06-17T04:44:49.637","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields."},{"lang":"es","value":"Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. En versiones afectadas, Parse Server LiveQuery no elimina los campos protegidos en las clases, pasándolos al cliente. El LiveQueryController ahora elimina los campos protegidos de la respuesta del cliente. Es recomendado a usuarios actualizar. Los usuarios que no puedan actualizar deberán usar \"Parse.Cloud.afterLiveQueryEvent\" para eliminar manualmente los campos protegidos"}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"parse-community","product":"parse-server","versions":[{"version":"< 4.10.13","status":"affected"},{"version":">= 5.0.0, < 5.2.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4.2}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","baseScore":6.4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10.0,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-04-23T15:53:41.598475Z","id":"CVE-2022-31112","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-200"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-212"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionEndExcluding":"4.10.13","matchCriteriaId":"9C3D4EDC-0BE1-411C-93E3-2351A4E7B3D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionStartIncluding":"5.0.0","versionEndExcluding":"5.2.4","matchCriteriaId":"19505592-808A-437A-8893-FA009C4CA575"}]}]}],"references":[{"url":"https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6","source":"security-advisories@github.com","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/issues/8073","source":"security-advisories@github.com","tags":["Issue Tracking","Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/pull/8074","source":"security-advisories@github.com","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/5.2.4","source":"security-advisories@github.com","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/issues/8073","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/pull/8074","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Release Notes","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/5.2.4","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes","Third Party Advisory"]},{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}