Data Connector Rock
Approved changes feed: RSS · Atom
cpe:2.3:a:apollosapp:data-connector-rock:*:*:*:*:*:node.js:*:*
part: a version: * update: *
| Vendor | Apollosapp (15059024-be92-5e9b-aea2-7484b9b8419e) |
|---|---|
| Product | Data Connector Rock (2a73e293-ef7d-52b8-b015-c0c943b0aded) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | node.js |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-32691 |
vulnerable | 2026-06-08 05:32:07.845795 |
Auto-merging Person Records Compromised
HIGH (8.8)
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class.
Published: 2021-06-16T21:45:13.000Z
Updated: 2024-08-03T23:25:31.122Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.