Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@apollosproject/data-connector-rock

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.8npmAmendedPublished

    Auto-merging Person Records Compromised

    CVE-2021-32691 · GHSA-r578-pj6f-r4ff

    Affected
    • npm @apollosproject/data-connector-rock < 2.20.0
    Fixed in
    2.20.0· Vendor fix available
    Issue
    Impact New user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events). Patches We have released a security patch on v2.20.0. The solution was to create a duplicate person and then patch the new person with their profile details. Workarounds If you do not wish to upgrade your app to the new version, you can patch your server by overriding the create data source method on the People class. For more information If you have any questions or comments about this advisory: Email us at support@apollos.app

    Recommended action: Upgrade to 2.20.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →