Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's…
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- MongoDB
- Product
- PostgreSQL, MongoDB
- CVSS
- 6.5
- Exposure class
- Database
Why it ranks 8 (Routine)
- CVSS 6.5 medium
- Product class: database
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.