Description
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
parse-community parse-server
Default version status: unaffected
9.7.0 to < 9.10.5-alpha.10affected9.10.5-alpha.10unaffected
pkg:npm/parse-server