CiviCRM generates *.pdf files with the assistance of a PDF engine. It is compatible with multiple engines, including the default DOMPDF and the alternative wkhtmltopdf. The latter option is now unsupported and insecure. Sites should remove it.
(Note: wkhtmltopdf is not distributed by CiviCRM. This is a public service announcement to alert people who may have installed wkhtmltopdf as an add-on.)
The bundled library "PhpSpreadsheet" has issued multiple security advisories.
The helper function CRM_Utils_File::cleanDir() is used to cleanup certain data folders. In some situations, it might be tricked into deleting additional files outside of the target directory.
There are stored cross-site scripting vulnerabilities involving some variations of the "name" and "source" fields in certain backend screens.
Multiple AJAX end-points may be vulnerable to Cross Site Request Forgery.
This release updates a large number of older end-points originating circa CiviCRM 1.x-3.x. Detailed severity ratings were not assessed for all these end-points, but several samples were assessed. The severity ranged from "Not Critical" to "Moderately Critical". Thus, the overall issue is classified as "Moderately Critical".
In some parts of the CiviCRM administrative interface, the "Copy" or "Clone" actions are vulnerable to cross-site request forgery.
Next year, CiviCRM will celebrate 20 years of existence! And while some things have changed dramatically in both the community and software, our mission has remained the same: to ensure that all organizations, regardless of size, budget or focus, can access a world-class CRM.
Our commitment to this mission is as strong as ever and is, in fact, a primary driver behind an impending change in how we present CiviCRM via https//civicrm.org, its primary marketing channel.
At CiviCamp Hamburg at the start of June it was nice to finally share for the first time a project to improves how CiviCRM looks I've been working on for several years, alongside Rich 'Artful Robot' Lott and in close discussion with the core team. With the related extension just reaching version 0.7, after resolving dozens of issues raised during the Sprint, it feels time to introduce it to the wider community.
CiviCRM uses the Smarty template system for high-trust content (built-in template files, written by developers) and low-trust content (user-supplied templates, written by back-office users). Low-trust content is subject to sandboxing, but there were issues in how this was applied.
Web-pages which use the "Resources" API to inject JSON data ("settings") may create vectors for XSS attacks.
