Impact

If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).

Patches

Afflicted installations will also have to remove the offending collection from their database.

Yes, patched in 3.4.1

Workarounds

Yes, user can apply: 8709daf

References

Nothing other than this advisory at this time

For more information

If you have any questions or comments about this advisory:

• Open an issue in parse-server
• Email us at security@parseplatform.org