The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2013/08/10/1 | Mailing List Third Party Advisory |
| https://drupal.org/node/2059591 | Release Notes Vendor Advisory |
| https://drupal.org/node/2059593 | Release Notes Vendor Advisory |
| https://drupal.org/node/2059603 | Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2013/08/10/1 | Mailing List Third Party Advisory |
| https://drupal.org/node/2059591 | Release Notes Vendor Advisory |
| https://drupal.org/node/2059593 | Release Notes Vendor Advisory |
| https://drupal.org/node/2059603 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2013/08/10/1 - Mailing List, Third Party Advisory | |
| References | () https://drupal.org/node/2059591 - Release Notes, Vendor Advisory | |
| References | () https://drupal.org/node/2059593 - Release Notes, Vendor Advisory | |
| References | () https://drupal.org/node/2059603 - Patch, Vendor Advisory |
Information
Published : 2020-02-11 21:15
Updated : 2024-11-21 01:55
NVD link : CVE-2013-4225
Mitre link : CVE-2013-4225
CVE.ORG link : CVE-2013-4225
JSON object : View
Products Affected
restful_web_services_project
- restful_web_services