high7.5
CVE-2021-47986
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a per…
Impact
Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the repository linking to unreviewed code in a personal fork. Attackers could exploit this by specifying affected version tags in dependency declarations to execute unreviewed and potentially malicious code.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Parseplatform | Parse-Server | Versions 4.0.0, 4.0.3, 4.0.4, 4.0.6, 4.0.7, 4.0.8 |