« Volver al listado

CVE-2013-4662

Estado: ModificadaMedia (6.5)—

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Civicrm — Civicrm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2013-4662",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-01-29T18:55:26.637",
  "references": [
    {
      "url": "http://issues.civicrm.org/jira/browse/CRM-12765",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://issues.civicrm.org/jira/browse/CRM-12765",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://civicrm.org/advisory/civi-sa-2013-004-limited-sql-injection-quick-search-api",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the \"second layer\" of the API, related to contact.getquick."
    },
    {
      "lang": "es",
      "value": "Quick Search API en CiviCRM 4.2.0 hasta la versión 4.2.9 y 4.3.0 hasta 4.3.3 permite a usuarios remotos autenticados evadir la capa de validación y llevar a cabo ataques de inyecciones de SQL a través de peticiones directas hacia una \"segunda capa\" de la API, relacionada con contact.getquick."
    }
  ],
  "lastModified": "2026-06-16T23:57:40.930",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C8CBF12E-640F-4752-8F52-B5B3D4015FC6"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A22C3AE-2E98-465C-B24C-725BEB99E943"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21DDDCA1-78A1-4FFB-B180-7D0D20FE4FDA"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C5B0394-3C38-454F-BF55-82AADCDEBE9A"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F3D157E-9132-4EA9-A395-6E46C4C3C032"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33E5813B-160F-48B2-91B2-4599048028A6"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC6A767A-D530-479B-9E3B-6FB49FD0B8FB"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D80D5F9-B4D9-41C9-B157-3FE31B54EDBF"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.2.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1647D812-6174-4613-B57B-8BEF5C3877C5"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "074C6767-AC29-4A80-8A51-16DD69BFEAA3"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE6A4EB0-3143-41AF-B4CF-26C736BEF2A4"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B8BBCB1-99D0-4634-BAD6-495B9D040A4C"
            },
            {
              "criteria": "cpe:2.3:a:civicrm:civicrm:4.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECC01A92-9252-4184-B11A-39D077E761C5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}