PT-2014-2847 · Civicrm · Civicrm

Donald Lobo + 2 · Publicado 2014-01-29 · Atualizado 2014-02-21 · CVE-2013-4661

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CiviCRM versions 2.0.0 through 4.2.9 CiviCRM versions 4.3.0 through 4.3.3

Description The issue is related to the improper enforcement of role-based access control (RBAC) restrictions for default custom searches. This allows remote authenticated users with the access CiviCRM permission to bypass intended access restrictions. For example, they can access custom contribution data without having the access CiviContribute permission.

Recommendations For CiviCRM versions 2.0.0 through 4.2.9, update to a version that properly enforces RBAC restrictions. For CiviCRM versions 4.3.0 through 4.3.3, update to a version that properly enforces RBAC restrictions. As a temporary workaround, consider restricting the access CiviCRM permission to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4661

Produtos afetados

Civicrm

Referências · 5

• http://civicrm.org/advisory/civi-sa-2013-003-custom-search-permissions · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4661 · Nota de Segurança
• http://issues.civicrm.org/jira/browse/CRM-12747 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4661 · Nota
• http://civicrm.org/advisory/civi-sa-2013-003 · Aviso do Fabricante