UStrive fixes data vulnerability exposing user personal information | Ukraine news - #Mezha

UStrive’s online mentoring platform has officially closed a vulnerability that allowed exposure to users’ personal data, including minors.

The vulnerability exposed full names, email addresses, phone numbers, and other confidential data that were accessible to any logged-in user of the platform.

The nonprofit organization, formerly known as Strive for College, provides online mentoring to high-school students and undergraduates through its platform. The organization has not stated whether it plans to notify users the security incident.

Last week, an anonymous user contacted TechCrunch with a report of a vulnerability on the UStrive platform. By reviewing traffic during login and site – specifically user profiles – any visitor could see streams of personal data through the browser’s developer tools.

According to a source, UStrive relied on a vulnerable GraphQL endpoint hosted on Amazon servers, which exposed large swaths of user data. In some records there was information provided by students, including gender and date of birth. The source said that at the time of exposure there were at least 238,000 user records. Meanwhile, the UStrive homepage claimed that more than 1.1 million students were using the mentoring service.

TechCrunch confirmed the data disclosure after creating a new account on UStrive and emailing the company’s executives on the day of publication.

“is currently in litigation with one of its former software engineers,”

A lawyer from the Virginia-based firm McIntyre Stein, representing UStrive, John D. MacIntair in a letter provided to TechCrunch on the same day, said that the company “is currently in litigation with one of its former software engineers” and therefore has “somewhat limited ability to respond” to requests.

“somewhat limited in its ability to respond.”

TechCrunch noted that in response to the initial , Chief Technology Officer Dwamian Mcleish said via email that the disclosure had been “remedied.”

The TechCrunch editorial team sent additional questions the incident: whether the company plans to notify users the vulnerability, whether unauthorized or malicious access to data was recorded, and whether a security audit of the platform has been conducted – and if so, by whom.

Founder Michael J. Carter did not on the material.

We should also note the author of this briefing: Zack Whittaker – TechCrunch’s Senior Security Editor and the author of the weekly “This Week in Security.”

You can reach him via encrypted Signal message at zackwhittaker.1337 or by email at [email protected] .

Other news you may find interesting: