-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaScriptJavaScriptMiggo AIRoot Cause AnalysisThe vulnerability stemmed from how client IPs were determined. The original getClientIp function in middlewares.js directly used x-forwarded-for header and other network properties without proper proxy configuration checks. This allowed attackers to spoof IPs by manipulating headers when trustProxy wasn't set. The commit patched this by removing custom IP resolution logic and delegating to Express's req.ip which respects the trustProxy setting. The removed test cases in Middlewares.spec.js further confirm these IP resolution paths were considered vulnerable.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| parse-server | npm | < 5.4.1 | 5.4.1 |
Ongoing coverage of React2Shell