github - ghsa-cc8q-cj34-v366

ghsa-cc8q-cj34-v366

Vulnerability from github

Published

2022-05-05 00:29

Modified

2023-02-02 21:34

Severity ?

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2013-4225"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-02-11T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.",
  "id": "GHSA-cc8q-cj34-v366",
  "modified": "2023-02-02T21:34:13Z",
  "published": "2022-05-05T00:29:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4225"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHEA-2014:1175"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2013-4225"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=997639"
    },
    {
      "type": "WEB",
      "url": "https://drupal.org/node/2059591"
    },
    {
      "type": "WEB",
      "url": "https://drupal.org/node/2059593"
    },
    {
      "type": "WEB",
      "url": "https://drupal.org/node/2059603"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2013/08/10/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2013-4225

Vulnerability from cvelistv5

Published

2020-02-11 20:19

Modified

2024-08-06 16:38

Severity ?

Summary

References

▼	URL	Tags
	https://drupal.org/node/2059603	x_refsource_MISC
	https://drupal.org/node/2059591	x_refsource_MISC
	https://drupal.org/node/2059593	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2013/08/10/1	x_refsource_MISC

Impacted products

▼	Vendor	Product
	RESTful Web Services	RESTful Web Services

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:38:01.575Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drupal.org/node/2059603"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drupal.org/node/2059591"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://drupal.org/node/2059593"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2013/08/10/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "RESTful Web Services",
          "vendor": "RESTful Web Services",
          "versions": [
            {
              "status": "affected",
              "version": "7.x-1.x before 7.x-1.4"
            },
            {
              "status": "affected",
              "version": "7.x-2.x before 7.x-2.1"
            }
          ]
        }
      ],
      "datePublic": "2013-08-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Insecure Permissions",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-11T20:19:56",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drupal.org/node/2059603"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drupal.org/node/2059591"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://drupal.org/node/2059593"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2013/08/10/1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2013-4225",
    "datePublished": "2020-02-11T20:19:56",
    "dateReserved": "2013-06-12T00:00:00",
    "dateUpdated": "2024-08-06T16:38:01.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted