RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

2024-05-1500:00:00

Drupal Security Team

www.drupal.org

drupal

restful

web services

access bypass

sa-contrib-2024-019

entities

AI Score

7.2

Confidence

Low

This module exposes Drupal resources (e.g. entities) as RESTful web services. The module doesn’t sufficiently restrict access for user resources.

Affected configurations

Vulners

Node

drupalrestfulRange<7.x-2.10

VendorProductVersionCPE
drupalrestful*cpe:2.3:a:drupal:restful:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
drupal	restful	*	cpe:2.3:a:drupal:restful::::::::

www.drupal.org/user/2495842

www.drupal.org/user/3064

AI Score

7.2

Confidence

Low