CVE-2022-24901
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 0.69 % · percentile 52 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Improper validation of the Apple certificate URL in the Apple Game Center authentication adapter allows attackers to bypass authentication, making the server vulnerable to DoS attacks. The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
Weaknesses (CWE)
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | GitHub_M |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-qf8x-vqjv-92gr — Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
European references
- ENISA EUVD · EUVD-2022-4956
- GCVE · GCVE-0-2022-24901
Affected configurations (NVD CPE)
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*< 4.10.10cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*≥ 5.0.0 < 5.2.1
Affected products
| Product | Versions |
|---|---|
| parse-community · parse-server | affected < 4.10.10 ; affected >= 5.0.0, < 5.2.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |