PT-2014-2847 · Civicrm · Civicrm

Donald Lobo + 2 · Published 2014-01-29 · Updated 2014-02-21 · CVE-2013-4661

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions CiviCRM versions 2.0.0 through 4.2.9 CiviCRM versions 4.3.0 through 4.3.3

Description The issue is related to the improper enforcement of role-based access control (RBAC) restrictions for default custom searches. This allows remote authenticated users with the access CiviCRM permission to bypass intended access restrictions. For example, they can access custom contribution data without having the access CiviContribute permission.

Recommendations For CiviCRM versions 2.0.0 through 4.2.9, update to a version that properly enforces RBAC restrictions. For CiviCRM versions 4.3.0 through 4.3.3, update to a version that properly enforces RBAC restrictions. As a temporary workaround, consider restricting the access CiviCRM permission to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4661

Affected Products

Civicrm

References · 5

• http://civicrm.org/advisory/civi-sa-2013-003-custom-search-permissions · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4661 · Security Note
• http://civicrm.org/advisory/civi-sa-2013-003 · Vendor Advisory
• http://issues.civicrm.org/jira/browse/CRM-12747 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4661 · Note