Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-4225

The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.

Published

2020-02-11T21:15:10.830

Last Modified

2024-11-21T01:55:09.930

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-79
CWE-94

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	restful_web_services_project	restful_web_services	< 7.x-1.4	Yes
Application	restful_web_services_project	restful_web_services	< 7.x-2.1	Yes
Application	restful_web_services_project	restful_web_services	7.x-2.x	Yes

References

http://www.openwall.com/lists/oss-security/2013/08/10/1 Mailing List, Third Party Advisory ([email protected])
https://drupal.org/node/2059591 Release Notes, Vendor Advisory ([email protected])
https://drupal.org/node/2059593 Release Notes, Vendor Advisory ([email protected])
https://drupal.org/node/2059603 Patch, Vendor Advisory ([email protected])
http://www.openwall.com/lists/oss-security/2013/08/10/1 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://drupal.org/node/2059591 Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://drupal.org/node/2059593 Release Notes, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://drupal.org/node/2059603 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)