CVE-2023-46119

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-46119
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46119.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-46119
Aliases
Published
2023-10-25T00:03:55Z
Modified
2026-10-21T02:30:47Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Parse Server may crash when uploading file without extension
Details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-23"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46119.json"
}
References

Affected packages

Git / github.com/parse-community/parse-server

Affected ranges

Type
GIT
Repo
https://github.com/parse-community/parse-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ff4639ab352ae88c335f650de345be11f2b649b0
Introduced
f7eee19dbad96f15440848a45e9ba4b2c0436f03
Fixed
b0c012e835d573fbddf3c0efc27a6b139fe3f097
Fixed
686a9f282dc23c31beab3d93e6d21ccd0e1328fe
Fixed
fd86278919556d3682e7e2c856dfccd5beffbfc0
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "5.5.6"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "fixed":  "6.3.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "686a9f282dc23c31beab3d93e6d21ccd0e1328fe"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "fd86278919556d3682e7e2c856dfccd5beffbfc0"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "5.5.6",
            "range":  [
                {
                    "fixed":  "ff4639ab352ae88c335f650de345be11f2b649b0"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "6.3.1",
            "range":  [
                {
                    "fixed":  "b0c012e835d573fbddf3c0efc27a6b139fe3f097"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.2.0
2.2.1
2.2.10
2.2.11
2.2.12
2.2.13
2.2.14
2.2.15
2.2.16
2.2.17
2.2.18
2.2.19
2.2.2
2.2.20
2.2.21
2.2.22
2.2.23
2.2.24
2.2.25
2.2.25-beta.1
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.4.0
2.4.1
2.4.2
2.5.0
2.5.1
2.5.2
2.5.3
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.8.0
2.8.2
3.*
3.0.0
3.1.0
3.1.1
3.1.2
3.1.3
3.10.0
3.2.0
3.2.1
3.2.2
3.2.3
3.3.0
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.7.2
3.8.0
3.9.0
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.2.0
4.3.0
4.4.0
4.5.0
5.*
5.0.0
5.0.0-alpha.1
5.1.0
5.1.1
5.2.0
5.2.1
5.2.2
5.2.3
5.2.4
5.2.5
5.2.6
5.2.7
5.2.8
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
6.*
6.0.0
6.1.0
6.2.0
6.2.1
6.2.2
6.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46119.json"