CVE-2013-4661

Severity

49%

Complexity

68%

Confidentiality

81%

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.

CVSS 2.0 Base Score 4.9. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:S/C:P/I:P/A:N).

Overview

First reported 11 years ago

2014-01-29 18:55:00

Last updated 11 years ago

2014-02-21 19:35:00

Affected Software

CiviCRM 4.0.5

4.0.5

CiviCRM 4.1.0

4.1.0

CiviCRM 4.1.1

4.1.1

CiviCRM4.1.2

4.1.2

CiviCRM4.1.3

4.1.3

CiviCRM 4.1.4

4.1.4

CiviCRM4.1.5

4.1.5

CiviCRM 4.1.6

4.1.6

CiviCRM 4.2.0

4.2.0

CiviCRM 4.2.1

4.2.1

CiviCRM 4.2.2

4.2.2

CiviCRM 4.2.4

4.2.4

CiviCRM 4.2.5

4.2.5

CiviCRM 4.2.6

4.2.6

CiviCRM 4.2.7

4.2.7

CiviCRM 4.2.8

4.2.8

CiviCRM 4.2.9

4.2.9

CiviCRM 4.3.0

4.3.0

CiviCRM 4.3.1

4.3.1

CiviCRM 4.3.2

4.3.2

CiviCRM 4.3.3

4.3.3

References

http://civicrm.org/advisory/civi-sa-2013-003

Vendor Advisory

http://civicrm.org/advisory/civi-sa-2013-003-custom-search-permissions