CVE-2013-4225

HighCVSS 8.8/10Last modified Jun 16, 2026

Description

The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
RESTful Web Services	RESTful Web Services	7.x-1.x before 7.x-1.4; 7.x-2.x before 7.x-2.1

References

http://www.openwall.com/lists/oss-security/2013/08/10/1Mailing List, Third Party Advisory
https://drupal.org/node/2059591Release Notes, Vendor Advisory
https://drupal.org/node/2059593Release Notes, Vendor Advisory
https://drupal.org/node/2059603Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2013/08/10/1Mailing List, Third Party Advisory
https://drupal.org/node/2059591Release Notes, Vendor Advisory
https://drupal.org/node/2059593Release Notes, Vendor Advisory
https://drupal.org/node/2059603Patch, Vendor Advisory

Timeline

Published: Feb 11, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-42266.5The Authenticated User Page Caching (Authcache) module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to cached pages, CVE-2013-42278.8Cross-site request forgery (CSRF) vulnerability in the persona_xsrf_token function in persona.module in the Mozilla Persona module 7.x-1.x b CVE-2013-42284.3The OG access fields (visibility fields) implementation in Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Drupal does not properly re CVE-2013-42292.1Cross-site scripting (XSS) vulnerability in the Monster Menus module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated users wi CVE-2013-42306.0The mm_webform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restri CVE-2013-42314.3Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1 CVE-2013-42326.8Use-after-free vulnerability in the t2p_readwrite_pdf_image function in tools/tiff2pdf.c in libtiff 4.0.3 allows remote attackers to cause a CVE-2013-42336.8Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial o CVE-2013-42346.8Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and ea CVE-2013-42354.7shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees CVE-2013-42362.7VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment CVE-2013-42376.8sysdeps/posix/readdir_r.c in the GNU C Library (aka glibc or libc6) 2.18 and earlier allows context-dependent attackers to cause a denial of