Access Control Flaw in CiviCRM Software by CiviCRM
CVE-2013-4661

Currently unrated

Key Information:

Vendor

Civicrm

Status
Civicrm
Vendor
CVE Published:
29 January 2014

What is CVE-2013-4661?

The vulnerability in CiviCRM allows remote authenticated users with the 'access CiviCRM' permission to bypass critical role-based access control restrictions. This flaw permits unauthorized access to sensitive data, like custom contribution information, without possessing the requisite permissions, thereby compromising data security and potentially leading to unauthorized data exposure.

References

http://issues.civicrm.org/jira/browse/CRM-12747
x_refsource_CONFIRM
http://civicrm.org/advisory/civi-sa-2013-003
x_refsource_CONFIRM
http://civicrm.org/advisory/civi-sa-2013-003-custom-searc...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.