CVE-2021-32691 Information

Description

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0 new user registrations are able to access anyone’s account by only knowing their basic profile information (name birthday gender etc). This includes all app functionality within the app as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround one can patch one’s server by overriding the create data source method on the People class.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/ApollosProject/apollos-apps/releases/tag/v2.20.0 https://github.com/ApollosProject/apollos-apps/commit/cb5f8f1c0b24f1b215b2bb5eb6f9a8e16d728ce2 https://github.com/ApollosProject/apollos-apps/security/advisories/GHSA-r578-pj6f-r4ff

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8