<div dir="ltr"><div class="gmail_quote">View online: <a href="https://www.drupal.org/sa-contrib-2024-019" rel="noreferrer" target="_blank">https://www.drupal.org/sa-contrib-2024-019</a><br>
<br>
Project: RESTful Web Services [1]<br>
Date: 2024-May-15<br>
Security risk: *Critical* 16∕25<br>
AC:None/A:None/CI:Some/II:None/E:Proof/TD:All [2]<br>
Vulnerability: Access bypass<br>
<br>
Description: <br>
This module exposes Drupal resources (e.g. entities) as RESTful web services.<br>
<br>
The module doesn't sufficiently restrict access for user resources.<br>
<br>
Solution: <br>
Install the latest version:<br>
<br>
   * If you use the RESTful Web Services module for Drupal 7, upgrade to<br>
     RESTful Web Services 7.x-2.10 [3]<br>
<br>
Reported By: <br>
   * Fran Garcia-Linares [4]<br>
<br>
Fixed By: <br>
   * Neil Drumm [5] of the Drupal Security Team<br>
   * Fran Garcia-Linares [6]<br>
<br>
Coordinated By: <br>
   * Neil Drumm [7] of the Drupal Security Team<br>
<br>
<br>
[1] <a href="https://www.drupal.org/project/restws" rel="noreferrer" target="_blank">https://www.drupal.org/project/restws</a><br>
[2] <a href="https://www.drupal.org/security-team/risk-levels" rel="noreferrer" target="_blank">https://www.drupal.org/security-team/risk-levels</a><br>
[3] <a href="https://www.drupal.org/project/restws/releases/7.x-2.10" rel="noreferrer" target="_blank">https://www.drupal.org/project/restws/releases/7.x-2.10</a><br>
[4] <a href="https://www.drupal.org/user/2495842" rel="noreferrer" target="_blank">https://www.drupal.org/user/2495842</a><br>
[5] <a href="https://www.drupal.org/user/3064" rel="noreferrer" target="_blank">https://www.drupal.org/user/3064</a><br>
[6] <a href="https://www.drupal.org/user/2495842" rel="noreferrer" target="_blank">https://www.drupal.org/user/2495842</a><br>
[7] <a href="https://www.drupal.org/user/3064" rel="noreferrer" target="_blank">https://www.drupal.org/user/3064</a><br>
<br>
_______________________________________________<br>
Security-news mailing list<br>
<a href="mailto:Security-news@drupal.org" target="_blank">Security-news@drupal.org</a><br>
Unsubscribe at <a href="https://lists.drupal.org/mailman/listinfo/security-news" rel="noreferrer" target="_blank">https://lists.drupal.org/mailman/listinfo/security-news</a><br>
</div><div class="gmail_quote"><br></div><div class="gmail_quote"><div><br class="gmail-Apple-interchange-newline">===</div><div>Computer Security Incident Response Team - CSIRT</div><div>Universidade Estadual de Campinas - Unicamp</div><div>Centro de Computacao - CCUEC</div><div>GnuPG Public Key: <a href="http://www.security.unicamp.br/security.asc" target="_blank">http://www.security.unicamp.br/security.asc</a> [^]</div><div>Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830</div><br class="gmail-Apple-interchange-newline"></div></div>