Security readout for executives and security teams
Plain-English summary
CVE-2021-47987 is a Parse Server supply-chain issue. Incorrect Git version tags pointed to an unreviewed personal fork, not approved release code. No official releases were published with those tags, and no malicious code was identified. Exposure appears limited to projects that directly depended on affected Git tags, such as a git-based parse-server#4.9.3 reference.
Executive priority
Prioritize this if Parse Server is used in production or build pipelines. The issue is high severity but appears narrowly exposed to Git-tag dependency usage. Treat as a supply-chain hygiene review rather than evidence of confirmed compromise.
Technical view
Parse Server before 4.10.0 was affected by incorrect repository tags resolving to unreviewed code. The issue is classified as CWE-494, download of code without integrity validation. CVSS v4.0 is 7.7 high. The main risk is arbitrary code execution from consuming untrusted dependency source, but public sources do not confirm malicious code or exploitation.
Likely exposure
Organizations are likely exposed only if their application manifests or lockfiles reference Parse Server through Git tags affected by this incident. Standard npm package releases were reportedly not published with these tags.
Exploitation context
No KEV listing is present, and the provided sources do not report active exploitation. The risk is supply-chain execution during dependency installation or runtime if an application consumed the unreviewed fork through a Git tag.
Researcher notes
The advisory states no malicious code was identified, but vulnerabilities could not be ruled out. Public evidence is limited on exact affected tags beyond examples. Avoid broad claims that all Parse Server deployments were exploitable; exposure depends on dependency resolution path.
Mitigation direction
- Review vendor advisory for affected tags and recommended actions.
- Replace Git-based Parse Server dependencies with trusted official release sources.
- Upgrade Parse Server to version 4.10.0 or later where applicable.
- Regenerate lockfiles after dependency correction.
- Review deployed artifacts built during the exposure window.
Validation and detection
- Search package manifests for Git-based parse-server dependencies.
- Inspect lockfiles for parse-server Git URLs or tag references.
- Confirm no dependency resolves to an unreviewed fork.
- Verify deployed builds use trusted Parse Server release artifacts.
- Document whether parse-server#4.9.3 or similar tag references were used.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-494: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-47987 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9VulnCheckVulnerability scoring details
Base CVSS 4.0 score
7.7HighVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-593v-wcqx-hq2w)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: Parse Server - Arbitrary Code Execution via Malicious Version TagsCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Download of Code Without Integrity Check
Download of Code Without Integrity Check represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.