{"id":"CVE-2022-39313","published":"2022-10-24T00:00:00Z","modified":"2025-04-23T16:45:01Z","title":"Parse Server crashes when receiving file download request with invalid byte range","vendor":"parse-community","product":"parse-server","tier":"tail","description":{"text":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been patched in versions 4.10.17, and 5.2.8. There are no known workarounds.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00814,"percentile":0.57041,"provenance":"source"},"cwes":[{"id":"CWE-1284","name":"Improper Validation of Specified Quantity in Input"}],"references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3","tags":[]}],"priority":{"score":16.7,"factors":[{"name":"EPSS percentile","points":11.41},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"parse-community","affectedVersions":[{"vendor":"parse-community","product":"parse-server","versions":["< 4.10.17",">= 5.0.0, < 5.2.8"]}],"affected":[{"ecosystem":"npm","package":"parse-server","vulnerableRanges":["<4.10.17",">=5.0.0, <5.2.8"],"patched":["4.10.17","5.2.8"],"from":["GHSA-h423-w6qv-2wj3"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-7100","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-parse-community-parse-server-cve-2020-5251","parents":[{"from":"CVE-2022-31089","to":"CVE-2022-39313","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Routers/FilesRouter.js"],"commits":["https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92","https://github.com/parse-community/parse-server/commit/066f29673ab4030b6b5b90c0c0326f7d3fe7612a","https://github.com/parse-community/parse-server/commit/3d7a61ecd5231638f01ff1a965b6313043c594a7"],"basis":"shared function","functions":["FilesRouter"]}]}],"children":[{"from":"CVE-2022-39313","to":"CVE-2023-36475","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Routers/FilesRouter.js"],"commits":["https://github.com/parse-community/parse-server/commit/066f29673ab4030b6b5b90c0c0326f7d3fe7612a","https://github.com/parse-community/parse-server/commit/3d7a61ecd5231638f01ff1a965b6313043c594a7","https://github.com/parse-community/parse-server/commit/3dd99dd80e27e5e1d99b42844180546d90c7aa90","https://github.com/parse-community/parse-server/commit/5fad2928fb8ee17304abcdcf259932f827d8c81f"],"basis":"shared function","functions":["FilesRouter"]}]},{"from":"CVE-2022-39313","to":"CVE-2023-46119","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Routers/FilesRouter.js"],"commits":["https://github.com/parse-community/parse-server/commit/066f29673ab4030b6b5b90c0c0326f7d3fe7612a","https://github.com/parse-community/parse-server/commit/3d7a61ecd5231638f01ff1a965b6313043c594a7","https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe","https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0"],"basis":"shared function","functions":["FilesRouter"]}]},{"from":"CVE-2022-39313","to":"CVE-2025-64430","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/Routers/FilesRouter.js"],"commits":["https://github.com/parse-community/parse-server/commit/066f29673ab4030b6b5b90c0c0326f7d3fe7612a","https://github.com/parse-community/parse-server/commit/3d7a61ecd5231638f01ff1a965b6313043c594a7","https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51","https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585"],"basis":"shared function","functions":["FilesRouter"]}]}],"packageHistory":[{"cve":"CVE-2022-36079","published":"2022-09-07","fixed":"5.2.5","kev":false},{"cve":"CVE-2022-39225","published":"2022-09-23","fixed":"5.2.6","kev":false},{"cve":"CVE-2022-39231","published":"2022-09-23","fixed":"5.2.7","kev":false,"link":{"from":"CVE-2022-39231","to":"CVE-2022-39313","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"4.10.16","toFixed":"4.10.17","daysApart":31},{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"5.2.7","toFixed":"5.2.8","daysApart":31}]}},{"cve":"CVE-2022-39313","published":"2022-10-24","fixed":"5.2.8","kev":false},{"cve":"CVE-2022-39396","published":"2022-11-10","fixed":"5.3.1","kev":false,"link":{"from":"CVE-2022-39313","to":"CVE-2022-39396","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"4.10.17","toFixed":"4.10.18","daysApart":17},{"kind":"version-step","provenance":"source","package":"npm:parse-server","fromFixed":"5.2.8","toFixed":"5.3.1","daysApart":17}]}},{"cve":"CVE-2022-41878","published":"2022-11-10","fixed":"5.3.2","kev":false},{"cve":"CVE-2022-41879","published":"2022-11-10","fixed":"5.3.3","kev":false}],"package":"npm:parse-server"}}