CVE-2013-4225

{"containers": {"cna": {"affected": [{"product": "RESTful Web Services", "vendor": "RESTful Web Services", "versions": [{"status": "affected", "version": "7.x-1.x before 7.x-1.4"}, {"status": "affected", "version": "7.x-2.x before 7.x-2.1"}]}], "datePublic": "2013-08-07T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field."}], "problemTypes": [{"descriptions": [{"description": "Insecure Permissions", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2020-02-11T20:19:56.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://drupal.org/node/2059603"}, {"tags": ["x_refsource_MISC"], "url": "https://drupal.org/node/2059591"}, {"tags": ["x_refsource_MISC"], "url": "https://drupal.org/node/2059593"}, {"tags": ["x_refsource_MISC"], "url": "http://www.openwall.com/lists/oss-security/2013/08/10/1"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:38:01.575Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://drupal.org/node/2059603"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://drupal.org/node/2059591"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://drupal.org/node/2059593"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2013/08/10/1"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-4225", "datePublished": "2020-02-11T20:19:56.000Z", "dateReserved": "2013-06-12T00:00:00.000Z", "dateUpdated": "2024-08-06T16:38:01.575Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "RESTful Web Services", "vendor": "RESTful Web Services", "versions": [{"status": "affected", "version": "7.x-1.x before 7.x-1.4"}, {"status": "affected", "version": "7.x-2.x before 7.x-2.1"}]}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:restful_web_services_project:restful_web_services:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "D0D6A8BA-0364-44BB-9F43-0594945193F1", "versionEndExcluding": "7.x-1.4", "versionStartIncluding": "7.x-1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:restful_web_services_project:restful_web_services:*:*:*:*:*:drupal:*:*", "matchCriteriaId": "B7AA02CE-91AC-4A81-B62B-BBAF75265E52", "versionEndExcluding": "7.x-2.1", "versionStartIncluding": "7.x-2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:restful_web_services_project:restful_web_services:7.x-2.x:dev:*:*:*:drupal:*:*", "matchCriteriaId": "38E1C460-2601-4231-A621-051C78C36929", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field."}, {"lang": "es", "value": "El m\u00f3dulo RESTful Web Services (restws) versiones 7.x-1.x anteriores a 7.x-1.4 y versiones 7.x-2.x anteriores a 7.x-2.1 para Drupal, no restringe apropiadamente el acceso a las operaciones de escritura de entidades, lo que facilita a usuarios autenticados remotos con los permisos de \"access resource node\" y \"create page content\" (o equivalentes) conducir un ataque de tipo cross-site scripting (XSS) o ejecutar c\u00f3digo PHP arbitrario por medio de un campo de texto dise\u00f1ado."}], "id": "CVE-2013-4225", "lastModified": "2026-06-16T23:56:50.790", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-02-11T21:15:10.830", "references": [{"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2013/08/10/1"}, {"source": "secalert@redhat.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://drupal.org/node/2059591"}, {"source": "secalert@redhat.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://drupal.org/node/2059593"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://drupal.org/node/2059603"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2013/08/10/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://drupal.org/node/2059591"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://drupal.org/node/2059593"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://drupal.org/node/2059603"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHEA-2014:1175", "cpe": "cpe:/a:redhat:satellite:6.0::el6", "package": "katello-0:1.5.0-30.el7sat", "product_name": "Red Hat Satellite 6.0", "release_date": "2014-09-10T00:00:00Z"}], "bugzilla": {"description": "Katello: proxied Candlepin calls authorization bypass", "id": "997639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=997639"}, "csaw": false, "cvss": {"cvss_base_score": "6.5", "cvss_scoring_vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "status": "verified"}, "cwe": "CWE-862", "details": ["The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.", "A flaw was found where incorrect permission checks in Katello led to certain HTTP API calls being accessible without a proper certificate. An attacker could use this vulnerability to view and alter subscription information for managed systems."], "name": "CVE-2013-4225", "package_state": [{"cpe": "cpe:/a:redhat:cloudforms_managementengine:5", "fix_state": "Affected", "package_name": "katello", "product_name": "CloudForms Management Engine 5"}, {"cpe": "cpe:/a:rhel_sam:1", "fix_state": "Affected", "package_name": "katello", "product_name": "Red Hat Subscription Asset Manager"}], "public_date": "2014-07-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-4225\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-4225"], "threat_severity": "Important"}

{}