CVE-2013-4225
N/A
N/A
Summary
The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| RESTful Web Services | RESTful Web Services | 7.x-1.x before 7.x-1.4 | affected |
| RESTful Web Services | RESTful Web Services | 7.x-2.x before 7.x-2.1 | affected |
Weaknesses
- Insecure Permissions
ADP Enrichment
CVE Program Container
Additional References
- https://drupal.org/node/2059603
- https://drupal.org/node/2059591
- https://drupal.org/node/2059593
- http://www.openwall.com/lists/oss-security/2013/08/10/1
References
- https://drupal.org/node/2059603
- https://drupal.org/node/2059591
- https://drupal.org/node/2059593
- http://www.openwall.com/lists/oss-security/2013/08/10/1
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.