Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-36079

24
FAUCET Score

CVE-2022-36079 affects Parse Server versions prior to 4.10.14 and 5.2.5, allowing attackers to enumerate internal or protected fields by using them as query constraints. This vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity that can lead to high confidentiality impact. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the potential for unauthorized information disclosure remains. Organizations using affected Parse Server versions should upgrade or implement the recommended workaround to mitigate this risk.

Impacted Technologies

VendorProductVersion(s)CPE
< 4.10.14CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
>= 5.0.0, < 5.2.5CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

8.6HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
4.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.00%
Probability of exploitation in next 30 days
EPSS Percentile
59.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0100 is in the 35th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: parse-serverFixed in: 4.10.14
npmpatch availablevia ghsa
Product: parse-serverFixed in: 5.2.5

Vendor Advisories (1)

npmGHSA-2m6g-crv8-p3c6high

Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

Sep 16, 2022

References

github.com / parse-community/parse-server/commit/634c44acd18f6ee6ec60fac89a2b602d92799bec
PatchThird Party Advisory
github.com / parse-community/parse-server/commit/e39d51bd329cd978589983bd659db46e1d45aad4
PatchThird Party Advisory
github.com / parse-community/parse-server/issues/8143
Issue TrackingThird Party Advisory
github.com / parse-community/parse-server/issues/8144
Issue TrackingThird Party Advisory
github.com / parse-community/parse-server/releases/tag/4.10.14
Release NotesThird Party Advisory
github.com / parse-community/parse-server/releases/tag/5.2.5
Release NotesThird Party Advisory
github.com / parse-community/parse-server/security/advisories/GHSA-2m6g-crv8-p3c6
Third Party Advisory