[SECURITY-L] [Security-news] RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

[CSIRT Unicamp]

View online: https://www.drupal.org/sa-contrib-2024-019

Project: RESTful Web Services [1]
Date: 2024-May-15
Security risk: *Critical* 16∕25
AC:None/A:None/CI:Some/II:None/E:Proof/TD:All [2]
Vulnerability: Access bypass

Description:
This module exposes Drupal resources (e.g. entities) as RESTful web
services.

The module doesn't sufficiently restrict access for user resources.

Solution:
Install the latest version:

   * If you use the RESTful Web Services module for Drupal 7, upgrade to
     RESTful Web Services 7.x-2.10 [3]

Reported By:
   * Fran Garcia-Linares [4]

Fixed By:
   * Neil Drumm [5] of the Drupal Security Team
   * Fran Garcia-Linares [6]

Coordinated By:
   * Neil Drumm [7] of the Drupal Security Team


[1] https://www.drupal.org/project/restws
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/restws/releases/7.x-2.10
[4] https://www.drupal.org/user/2495842
[5] https://www.drupal.org/user/3064
[6] https://www.drupal.org/user/2495842
[7] https://www.drupal.org/user/3064

_______________________________________________
Security-news mailing list
Security-news em drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news


===
Computer Security Incident Response Team - CSIRT
Universidade Estadual de Campinas - Unicamp
Centro de Computacao - CCUEC
GnuPG Public Key: http://www.security.unicamp.br/security.asc [^]
Contato: +55 19 3521-2289 ou INOC-DBA: 1251*830
-------------- Próxima Parte ----------
Um anexo em HTML foi limpo...
URL: <http://www.listas.unicamp.br/pipermail/security-l/attachments/20240515/b589abef/attachment.html>