Detections
Analytics

SCA: security update for parse-server (GHSA-837q-jhwx-cmpv)

medium Tenable Self-Hosted Container Security Plugin ID 421180

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.
 Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication
 credentials of some specific authentication providers to be used across multiple Parse Server apps. For
 example, if a user signed up using the same authentication provider in two unrelated Parse Server apps,
 the credentials stored by one app can be used to authenticate the same user in the other app. Note that
 this only affects Parse Server apps that specifically use an affected 3rd party authentication provider
 for user authentication, for example by setting the Parse Server option auth to configure a Parse Server
 authentication adapter. The fix of this vulnerability requires to upgrade Parse Server to a version that
 includes the bug fix, as well as upgrade the client app to send a secure payload, which is different from
 the previous insecure payload. This vulnerability is fixed in 7.5.2 and 8.0.2. (CVE-2025-30168)

See Also

https://github.com/advisories/GHSA-837q-jhwx-cmpv

Plugin Details

Severity: Medium

ID: 421180

Version: Revision 1.14

Type: Local

Family: SCA Checks

Published: 3/21/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.46

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 4.5

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:P/A:N

CVSS Score Source: CVE-2025-30168

CVSS v3

Risk Factor: Medium

Base Score: 6.9

Temporal Score: 6

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/21/2025

Vulnerability Publication Date: 3/21/2025

Reference Information

CVE: CVE-2025-30168

cwe: CWE-287