CVE-2021-32691

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Incorrect Implementation of Authentication Algorithm pada apollosapp data-connector-rock. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). There is a patch in version 2.20.0. As a workaround, one can patch one's server by overriding the `create` data source method on the `People` class.

Rincian

Terbit di NVD

16 Juni 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-303: Incorrect Implementation of Authentication Algorithm
CWE-287: Improper Authentication

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 72,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ApollosProject/apollos-apps/commit/cb5f8f1c0b24f1b215b2bb5eb6f9a8e16d728ce2 patch · advisory pihak ketiga
• https://github.com/ApollosProject/apollos-apps/releases/tag/v2.20.0 patch · advisory pihak ketiga
• https://github.com/ApollosProject/apollos-apps/security/advisories/GHSA-r578-pj6f-r4ff mitigasi · advisory pihak ketiga