Security Risk:
Critical
Vulnerability:
Access Bypass
Affected Versions:
- CiviCRM versions between 4.7.0 and 5.19.1
Fixed Versions:
- CiviCRM 5.19.2 and 5.13.7
Publication Date:
Wednesday, November 20, 2019
Description:
The field "api_key" has special security rules when accessed via the API. These rules could potentially be bypassed and lead to privilege escalation.
Solutions:
Upgrade to the latest version of CiviCRM
Credits:
Coleman Watts of CiviCRM for reporting.
Coleman Watts of CiviCRM, Tim Otten of CiviCRM, and Seamus Lee of Australian Greens for fixing the issue
References:
security/core#62
