{"id":"CVE-2022-31112","aliases":["BIT-parse-2022-31112","EUVD-2022-6325","GHSA-crrq-vr9j-fxxh"],"status":"published","title":"Protected fields exposed via LiveQuery in parse-server","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.","severity":{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01336,"percentile":0.71441,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-212"],"published":"2022-06-30T16:40:13Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"npm","package":"parse-server","fixed_in":["4.10.13","5.2.4"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"parse","fixed_in":["4.10.13","5.2.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.13"}]}]},{"source":"ghsa","ecosystem":"npm","package":"parse-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"parse","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.13"},{"introduced":"5.0.0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.10.13"}]}]},{"source":"osv","ecosystem":"npm","package":"parse-server","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.2.4"}]}]}],"products":[{"vendor":"parse-community","product":"parse-server"},{"vendor":"parseplatform","product":"parse-server"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/parse-community/parse-server/issues/8073","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Release Notes","Third Party Advisory","advisory","report","web"]},{"url":"https://github.com/parse-community/parse-server/pull/8074","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","advisory","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/309f64ced8700321df056fb3cc97f15007a00df1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://github.com/parse-community/parse-server/commit/9fd4516cde5c742f9f29dd05468b4a43a85639a6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","web"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/5.2.4","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31112","tags":["web","advisory"]},{"url":"https://github.com/parse-community/parse-server/commit/054f3e6ab01d66a0dcfb77725af28eac1485b375","tags":["web"]},{"url":"https://github.com/advisories/GHSA-crrq-vr9j-fxxh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31112.json","tags":["advisory"]},{"url":"https://github.com/parse-community/parse-server","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31112","title":"Protected fields exposed via LiveQuery in parse-server","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.","status":"published","published":"2022-06-30T16:40:13Z","modified":"2025-04-23T18:05:16.778Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-6325","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.","status":"published","published":"2022-06-30T16:40:13Z","modified":"2025-04-23T18:05:16Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:09.919052Z"}],"ghsa":[{"id":"GHSA-crrq-vr9j-fxxh","title":"Protected fields exposed via LiveQuery","description":"### Impact\n\nParse Server LiveQuery does not remove protected fields in classes, passing them to the client.\n\n### Patches\nThe LiveQueryController now removes protected fields from the client response.\n\n### Workarounds\nUse `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.\n\n### References\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh\n- https://github.com/parse-community/parse-server\n\n### For more information\nIf you have any questions or comments about this advisory:\n- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)\n- Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org/)\n","status":"published","published":"2022-07-06T19:52:23Z","modified":"2023-07-24T19:37:44Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"nvd":[{"id":"CVE-2022-31112","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.","status":"published","published":"2022-06-30T17:15:07.977Z","modified":"2026-06-17T04:44:49.637Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T14:07:22.966735Z"}],"osv":[{"id":"CVE-2022-31112","title":"Protected fields exposed via LiveQuery in parse-server","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.","status":"published","published":"2022-06-30T16:40:13Z","modified":"2026-10-28T02:30:53.564760699Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-crrq-vr9j-fxxh","title":"Protected fields exposed via LiveQuery","description":"### Impact\n\nParse Server LiveQuery does not remove protected fields in classes, passing them to the client.\n\n### Patches\nThe LiveQueryController now removes protected fields from the client response.\n\n### Workarounds\nUse `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.\n\n### References\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh\n- https://github.com/parse-community/parse-server\n\n### For more information\nIf you have any questions or comments about this advisory:\n- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)\n- Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org/)\n","status":"published","published":"2022-07-06T19:52:23Z","modified":"2023-12-06T01:02:18.617929Z","cvss":[{"version":"3.1","score":8.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"BIT-parse-2022-31112","title":"Protected fields exposed via LiveQuery in parse-server","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.","status":"published","published":"2024-03-06T11:02:26.39Z","modified":"2026-09-08T08:48:24.481617768Z","updated_at":"2026-11-02T15:28:34.343258Z"}]}}