Published
2017-07-05 23:00
The pingback system is an optional mechanism which reports statistical data to civicrm.org. The pingback URL specified an unencrypted protocol (HTTP), and well-positioned eavesdropper could potentially intercept statistical data. The pingback URL should specify an encrypted protocol (HTTPS) to prevent eavesdropping.
Security Risk
Less Critical
Vulnerability
Information Disclosure
Affected Versions
- 4.7.20 and earlier
- 4.6.28 and earlier
Fixed Versions
- 4.7.21
- 4.6.29
Solutions
Upgrade to the latest version of CiviCRM
If you cannot upgrade you should apply either of the following patches:
Credits
Thanks to Nicolas Ganivent of CiviDesk for reporting the issue
Seamus Lee of Australian Greens for fixing
