CVE-2021-32691
High
Description
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class.
SeverityHigh
CVSS8.8
Exploit probability—
ProductApollosapp Data-connector-rock
PublishedJun 16, 2021
First seenJun 16, 2021
Weakness typeCWE-303CWE-303
How to fix
Update
- apollosapp data-connector-rock2.20.0 or later
- @apollosproject/data-connector-rock2.20.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apollosapp data-connector-rock | v < 2.20.0 | 2.20.0 |
| @apollosproject/data-connector-rocknpm | v < 2.20.0 | 2.20.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.