The vulnerability of the CKEditor configuration form in the CiviCRM interaction and connection management web system allows a perpetrator to compromise data integrity by manipulating cross-site requests.

The vulnerability of the CKEditor configuration form in the CiviCRM interaction and connection management web system is related to the falsification of cross-site requests. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of data...

CiviCRM < 5.28.1 - CSRF to Stored XSS

The plugin was vulnerable to CSRF on the CKEditor Configuration Form. The vulnerability was discovered by sonarsource. Update to versions 5.28.1 and above to patch the vulnerability...

CiviCRM < 5.24.3 - Authenticated Phar Deserialization

The plugin was vulnerable to Authenticated Phar Deserialization. The vulnerability was discovered by sonarsource. Update to versions 5.24.3 and above to patch the vulnerability...

CiviCRM 5.22.0 - Code Execution Vulnerability Chain Explained

During our vulnerability research on the largest CMS systems we came across CiviCRM last year. It’s an open source CRM plugin for the most popular CMS systems like Wordpress, Joomla, Drupal, and Backdrop. CiviCRM is specifically designed for the needs of non-profit, non-governmental, and advocacy...

WordPress CiviCRM plugin <= 5.24.2 - Authenticated Phar Deserialization vulnerability

Authenticated Phar Deserialization vulnerability discovered by Dennis Brinkrolf SonarSource in WordPress CiviCRM plugin versions = 5.24.2. Solution Update the WordPress CiviCRM plugin to the latest available version at least 5.24.3...

Cross-Site Request Forgery (CSRF)

civicrm/civicrm-core is vulnerable to cross-site request forgery. Lack of sufficient validation on the configuration form allows a malicious third-party to trick a CiviCRM administrator into changing the configuration...

CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

CVE-2020-36389

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...

CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

CVE-2020-36389

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...

DEBIAN-CVE-2020-36389

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...

CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

UBUNTU-CVE-2020-36389

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...

Cross site request forgery (csrf)

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...

Design/Logic Flaw

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

CVE-2020-36389

In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF...

UBUNTU-CVE-2020-36388

In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive...

CiviCRM 代码问题漏洞

CiviCRM is an open source, cloud-based member relationship management CRM system developed specifically to meet the needs of nonprofit and association-based organizations. A code issue vulnerability exists in CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3 versions, which allows an...

CVE-2020-36388

CVE-2020-36388 affects CiviCRM: versions prior to 5.21.3 and 5.22.x through 5.24.x prior to 5.24.3 expose a crafted PHAR archive upload that enables arbitrary code execution. The root cause is vulnerability in handling PHAR archives which allows remote code execution when a user can upload a mali...

CVE-2020-36389

The CVE-2020-36389 entry concerns a CSRF vulnerability in the CKEditor configuration form in CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR. The provided connected documents corroborate the affected software/versions and the underlying issue (CSRF in the CKEditor config form). No exploit...