Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access CiviCRM" permission to bypass intended access restrictions, as demonstrated by accessing custom contribution data without having the "access CiviContribute" permission.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CiviCRM 权限许可和访问控制漏洞
Vulnerability Description
CiviCRM是一套专用于非营利组织、非政府组织以及公益机构的客户关系管理系统。该系统可作为组织内部的业务管理，也可作为组织的联络、沟通以及追踪志愿者或支持者的关系和状态。 CiviCRM 2.0.0至4.2.9版本和4.3.0至4.3.3版本中存在权限许可和访问控制漏洞，该漏洞源于程序对默认的自定义搜索没有正确实施基于角色的访问控制(RBAC)限制操作。远程攻击者可利用该漏洞以‘access CiviCRM’权限绕过既定的访问限制。
CVSS Information
N/A
Vulnerability Type
N/A