CVE-2013-4225: XSS
The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4225?
CVE-2013-4225 has a medium severity rating due to improper access restrictions allowing unauthorized entity write operations.
How do I fix CVE-2013-4225?
To fix CVE-2013-4225, update the RESTful Web Services module to version 7.x-1.4 or 7.x-2.1 or later.
Who is affected by CVE-2013-4225?
CVE-2013-4225 affects Drupal instances using versions of the RESTful Web Services module prior to 7.x-1.4 and 7.x-2.1.
What types of permissions are involved in CVE-2013-4225?
CVE-2013-4225 concerns users with 'access resource node' and 'create page content' permissions that can exploit the vulnerability.
What can happen if CVE-2013-4225 is exploited?
Exploitation of CVE-2013-4225 allows remote authenticated users to perform unauthorized entity write operations.