CIVI-SA-2022-02: CiviEvent Importer, SQL Injection
When importing "Participant" records for CiviEvent, some inputs were not suitably escaped.
When importing "Participant" records for CiviEvent, some inputs were not suitably escaped.
When accessing the Contribution View page insufficient permission checking was occurring which meant that if you knew the url and had the access CiviCRM permission you would be able to view contribution information that you shouldn't have.
A few weeks prior to 24 February, I’d given up reading the news. It was a very happy time. Since Russia’s invasion of Ukraine, it’s been hard not to jump back into my Google news feed and periodically check in at NPR. Given the rise of misinformation over the past few years, it’s hard to know what is accurate and what isn’t, so much of what I read I take with a grain of salt.
In the fall of 2021, the CiviCRM Core Team revised and published a privacy policy on https://civicrm.org that meets the requirements set forth by both the European General Data Protection Regulation and the California Consumer Privacy Act. The revised policy is available at https://civicrm.org/privacy-policy
The 2021 annual report for the CiviCRM Core Team is now live at https://civicrm.org/annual-report just in time for the Community Round Tables tomorrow.
CiviCRM version 5.44.0 is now out and ready to download. This is a regular monthly release.
Upgrade now for the most stable CiviCRM experience:
Users of the CiviCRM Extended Security Releases (ESR) do not need to upgrade, as there are no ESR-specific bug-fixes or security issues at the moment. The current version of ESR is CiviCRM 5.39.x.
This most welcome enhancement will allow users to edit card details directly in CiviCRM when processing payments through Stripe, thereby making card updates a much easier process.
For a full roadmap of improvements to the Stripe extension, check out: https://docs.civicrm.org/stripe/en/latest/roadmap/#card-on-file-updating-card-details