CVE-2013-4661
Summary
| CVE | CVE-2013-4661 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-01-29 18:55:26 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission. |
Risk And Classification
Primary CVSS: v2.0 4.9 from [email protected]
AV:N/AC:M/Au:S/C:P/I:P/A:N
EPSS: 0.001710000 probability, percentile 0.379740000 (date 2026-05-04)
Problem Types: CWE-264 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:S/C:P/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Civicrm | Civicrm | 2.0.0 | All | All | All |
| Application | Civicrm | Civicrm | 2.0.1 | All | All | All |
| Application | Civicrm | Civicrm | 2.0.2 | All | All | All |
| Application | Civicrm | Civicrm | 2.0.3 | All | All | All |
| Application | Civicrm | Civicrm | 2.0.4 | All | All | All |
| Application | Civicrm | Civicrm | 2.0.5 | All | All | All |
| Application | Civicrm | Civicrm | 2.0.6 | All | All | All |
| Application | Civicrm | Civicrm | 2.0.7 | All | All | All |
| Application | Civicrm | Civicrm | 2.1.0 | All | All | All |
| Application | Civicrm | Civicrm | 2.1.1 | All | All | All |
| Application | Civicrm | Civicrm | 2.1.2 | All | All | All |
| Application | Civicrm | Civicrm | 2.1.4 | All | All | All |
| Application | Civicrm | Civicrm | 2.1.6 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.0 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.1 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.2 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.3 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.5 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.6 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.7 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.8 | All | All | All |
| Application | Civicrm | Civicrm | 2.2.9 | All | All | All |
| Application | Civicrm | Civicrm | 3.0.0 | All | All | All |
| Application | Civicrm | Civicrm | 3.0.1 | All | All | All |
| Application | Civicrm | Civicrm | 3.0.2 | All | All | All |
| Application | Civicrm | Civicrm | 3.0.3 | All | All | All |
| Application | Civicrm | Civicrm | 3.0.4 | All | All | All |
| Application | Civicrm | Civicrm | 3.1.1 | All | All | All |
| Application | Civicrm | Civicrm | 3.1.2 | All | All | All |
| Application | Civicrm | Civicrm | 3.1.3 | All | All | All |
| Application | Civicrm | Civicrm | 3.1.4 | All | All | All |
| Application | Civicrm | Civicrm | 3.1.5 | All | All | All |
| Application | Civicrm | Civicrm | 3.1.6 | All | All | All |
| Application | Civicrm | Civicrm | 3.2.0 | All | All | All |
| Application | Civicrm | Civicrm | 3.2.1 | All | All | All |
| Application | Civicrm | Civicrm | 3.2.2 | All | All | All |
| Application | Civicrm | Civicrm | 3.2.3 | All | All | All |
| Application | Civicrm | Civicrm | 3.2.4 | All | All | All |
| Application | Civicrm | Civicrm | 3.2.5 | All | All | All |
| Application | Civicrm | Civicrm | 3.3.0 | All | All | All |
| Application | Civicrm | Civicrm | 3.3.1 | All | All | All |
| Application | Civicrm | Civicrm | 3.3.2 | All | All | All |
| Application | Civicrm | Civicrm | 3.3.3 | All | All | All |
| Application | Civicrm | Civicrm | 3.3.5 | All | All | All |
| Application | Civicrm | Civicrm | 3.3.6 | All | All | All |
| Application | Civicrm | Civicrm | 3.4.0 | All | All | All |
| Application | Civicrm | Civicrm | 4.0.5 | All | All | All |
| Application | Civicrm | Civicrm | 4.1.0 | All | All | All |
| Application | Civicrm | Civicrm | 4.1.1 | All | All | All |
| Application | Civicrm | Civicrm | 4.1.2 | All | All | All |
| Application | Civicrm | Civicrm | 4.1.3 | All | All | All |
| Application | Civicrm | Civicrm | 4.1.4 | All | All | All |
| Application | Civicrm | Civicrm | 4.1.5 | All | All | All |
| Application | Civicrm | Civicrm | 4.1.6 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.0 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.1 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.2 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.4 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.5 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.6 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.7 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.8 | All | All | All |
| Application | Civicrm | Civicrm | 4.2.9 | All | All | All |
| Application | Civicrm | Civicrm | 4.3.0 | All | All | All |
| Application | Civicrm | Civicrm | 4.3.1 | All | All | All |
| Application | Civicrm | Civicrm | 4.3.2 | All | All | All |
| Application | Civicrm | Civicrm | 4.3.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| CIVI-SA-2013-003 - Custom Search Permissions | CiviCRM | af854a3a-2127-422b-91ae-364da2661108 | civicrm.org | Vendor Advisory |
| System Dashboard - CiviCRM Issue Tracker | af854a3a-2127-422b-91ae-364da2661108 | issues.civicrm.org | |
| Page not found | CiviCRM | af854a3a-2127-422b-91ae-364da2661108 | civicrm.org | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.