CVE-2013-4661

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which…

published January 29, 2014

CVSS
—
EPSS
1%
Percentile
62.2
In the wild
Unconfirmed
What it is

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00992 · 62.2th percentile
Published
2014-01-29T18:00Z
EPSS history
Timeline
  • 29 JAN 18:00Z
    CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which…
    cvelistv5