CWE-252
AllowedUnchecked Return Value
Abstraction: Base · Status: Draft
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
251 vulnerabilities reference this CWE, most recent first.
GHSA-XW6G-JJVF-WWF9
Vulnerability from github – Published: 2022-06-20 22:25 – Updated: 2022-06-20 22:25Impact
Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.
Patches
To prevent this, invalid requests are now properly handled.
Workarounds
None
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9
- https://github.com/parse-community/parse-server
For more information
- For questions or comments about this vulnerability visit our community forum or community chat
- Report other vulnerabilities at report.parseplatform.org
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.10.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "parse-server"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.2.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31089"
],
"database_specific": {
"cwe_ids": [
"CWE-252"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-20T22:25:46Z",
"nvd_published_at": "2022-06-27T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nCertain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.\n\n### Patches\nTo prevent this, invalid requests are now properly handled.\n\n### Workarounds\nNone\n\n### References\n- https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9\n- https://github.com/parse-community/parse-server\n\n### For more information\n- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)\n- Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org/)\n",
"id": "GHSA-xw6g-jjvf-wwf9",
"modified": "2022-06-20T22:25:46Z",
"published": "2022-06-20T22:25:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31089"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/parse-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Invalid file request can crash server"
}
Mitigation MIT-53
Check the results of all functions that return a value and verify that the value is expected.
Mitigation MIT-56
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Ensure that you account for all possible return values from the function.
Mitigation
When designing a function, make sure you return a value or throw an exception in case of an error.
No CAPEC attack patterns related to this CWE.