CVE-2013-4661 - CVE House
Back to Database
Status published Medium CVE-2013-4661

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not...

Vulnerability Description

CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-4661

Credits & Attribution

No credits recorded in the NVD database.

References

More from civicrm

View All →
CVE-2020-36389
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR,...
Medium 4.3
CVE-2020-36388
In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3,...
High 8.8
CVE-2015-4391
Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report...
Medium 6.8
CVE-2013-5957
Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12,...
High 7.5
CVE-2013-4662
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and...
Medium 6.5

Affected Vendor

Affected Software

civicrm
Vulnerable Versions:
2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.1.0, 2.1.1, 2.1.2, 2.1.4, 2.1.6, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.3.0, 3.3.1, 3.3.2, 3.3.3, 3.3.5, 3.3.6, 3.4.0, 4.0.5, 4.1.0, 4.1.1, 4.1.2, 4.1.3, 4.1.4, 4.1.5, 4.1.6, 4.2.0, 4.2.1, 4.2.2, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.3.0, 4.3.1, 4.3.2, 4.3.3

Timeline

Official Publish: January 29th, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.