Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2023-22474 Details

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value. This issue has been patched in version 5.4.1. The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy`.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:8.7 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8	CVE	PatchThird Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x	CVE	Third Party Advisory
https://security.netapp.com/advisory/ntap-20230309-0005/	CVE
https://github.com/parse-community/parse-server/commit/e016d813e083ce6828f9abce245d15b681a224d8	[email protected]	PatchThird Party Advisory
https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x	[email protected]	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-290	Authentication Bypass by Spoofing	[email protected]

Affected Products

Product	Versions
parseplatform parse-server	< 5.4.1
CPE cpe:2.3:a:parseplatform:parse-server::::::node.js::* Remediation No remediation found in references.

Change History

5 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Feb 10, 2023	Initial Analysis	[email protected]