QwikSec

Security Database

CVE

CWE

Training

CVE-2013-4661

Published: Jan 29, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://issues.civicrm.org/jira/browse/CRM-12747

x_refsource_CONFIRM

http://civicrm.org/advisory/civi-sa-2013-003

x_refsource_CONFIRM

http://civicrm.org/advisory/civi-sa-2013-003-custom-search-permissions

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.