Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wrzy-ar2d-kfe3
Vulnerability ID VCID-wrzy-ar2d-kfe3
Aliases CVE-2024-39309
GHSA-c2hr-cqg6-8j6r
Summary Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. The algorithm to detect SQL injection has been improved in versions 6.5.7 and 7.1.0. No known workarounds are available.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.03791 https://api.first.org/data/v1/epss?cve=CVE-2024-39309
epss 0.03791 https://api.first.org/data/v1/epss?cve=CVE-2024-39309
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-c2hr-cqg6-8j6r
cvssv3.1 9.8 https://github.com/parse-community/parse-server
generic_textual CRITICAL https://github.com/parse-community/parse-server
cvssv3.1 9.8 https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3
generic_textual CRITICAL https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3
ssvc Track https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3
cvssv3.1 9.8 https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b
generic_textual CRITICAL https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b
ssvc Track https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b
cvssv3.1 9.8 https://github.com/parse-community/parse-server/pull/9167
generic_textual CRITICAL https://github.com/parse-community/parse-server/pull/9167
ssvc Track https://github.com/parse-community/parse-server/pull/9167
cvssv3.1 9.8 https://github.com/parse-community/parse-server/pull/9168
generic_textual CRITICAL https://github.com/parse-community/parse-server/pull/9168
ssvc Track https://github.com/parse-community/parse-server/pull/9168
cvssv3.1 9.8 https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
cvssv3.1_qr CRITICAL https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
generic_textual CRITICAL https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
ssvc Track https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2024-39309
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2024-39309
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2024-39309
https://github.com/parse-community/parse-server
2edf1e4c0363af01e97a7fbc97694f851b7d1ff3 https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3
9167 https://github.com/parse-community/parse-server/pull/9167
9168 https://github.com/parse-community/parse-server/pull/9168
CVE-2024-39309 https://nvd.nist.gov/vuln/detail/CVE-2024-39309
f332d54577608c5ad927255e06d8c694e2e0ff5b https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b
GHSA-c2hr-cqg6-8j6r https://github.com/advisories/GHSA-c2hr-cqg6-8j6r
GHSA-c2hr-cqg6-8j6r https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-02T17:29:00Z/ Found at https://github.com/parse-community/parse-server/commit/2edf1e4c0363af01e97a7fbc97694f851b7d1ff3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-02T17:29:00Z/ Found at https://github.com/parse-community/parse-server/commit/f332d54577608c5ad927255e06d8c694e2e0ff5b
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/pull/9167
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-02T17:29:00Z/ Found at https://github.com/parse-community/parse-server/pull/9167
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/pull/9168
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-02T17:29:00Z/ Found at https://github.com/parse-community/parse-server/pull/9168
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-07-02T17:29:00Z/ Found at https://github.com/parse-community/parse-server/security/advisories/GHSA-c2hr-cqg6-8j6r
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-39309
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.88341
EPSS Score 0.03791
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-10T18:37:33.923951+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2024/39xxx/CVE-2024-39309.json 38.6.0