{"id":"CVE-2013-4225","aliases":["EUVD-2013-4129","GHSA-cc8q-cj34-v366","RHEA-2014:1175"],"status":"published","title":"The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for...","description":"The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02054,"percentile":0.8141,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79","CWE-94"],"published":"2020-02-11T20:19:56Z","modified":"2026-10-07T10:01:18Z","affected":[{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"libmongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"libmongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.6-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"mongodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"mongodb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"mongodb-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-30.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"katello","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.0-30.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-compute","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-gce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.44-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-9.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"v8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"v8-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.14.5.10-11.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.2-1.el6"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.2-1.el6"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-6.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-httplib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.0-6.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"foreman-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.0.30-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-kafo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.4-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-kafo_parsers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-2.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-hammer_cli_foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.1-16.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"rubygem-hammer_cli_foreman_tasks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-3.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-hammer_cli_foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.1-16.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"rubygem-hammer_cli_foreman_tasks","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-3.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el6","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-4.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el6","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-4.el6sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-5.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.0::el7","package":"python-simplejson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-anyjson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.3-5.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-simplejson","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:satellite:6.0::el7","package":"python-simplejson-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-1.el7sat"}]}],"bundled":24}],"products":[{"vendor":"drupal","product":"restful web services"},{"vendor":"restful web services","product":"restful web services"},{"vendor":"restful_web_services_project","product":"restful_web_services"}],"references":[{"url":"https://drupal.org/node/2059603","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://drupal.org/node/2059591","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://drupal.org/node/2059593","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2013/08/10/1","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4225","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHEA-2014:1175","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997639","tags":["report"]},{"url":"https://github.com/advisories/GHSA-cc8q-cj34-v366"},{"url":"https://access.redhat.com/site/documentation/","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1131602","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhea-2014_1175.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2012-6619","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049748","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2012-6619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-6619","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=963568","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2101","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=968166","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2121","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=991116","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2882","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2882","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=989755","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4180","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=990374","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4182","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4182","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=991318","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4201","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4201","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4225","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1013076","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4386","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6639","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039888","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6639","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1039889","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-6650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1059070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-6650","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-6650","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-7440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1224999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7440","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7440","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0007","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1105369","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0007","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0007","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071741","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0089","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0089","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1072151","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0090","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0090","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1072738","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0091","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0091","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0135","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0135","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0192","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1092354","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0192","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0192","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1094642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0208","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0208","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0241","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1099419","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0241","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0241","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-1704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1077136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1704","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1704","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3531","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1108745","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3531","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3531","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-4616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-4616","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4616","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-4225","description":"The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.","status":"published","published":"2020-02-11T20:19:56Z","modified":"2024-08-06T16:38:01.575Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2013-4129","description":"The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.","status":"published","published":"2020-02-11T20:19:56Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.70868Z"}],"ghsa":[{"id":"GHSA-cc8q-cj34-v366","title":"The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for...","description":"The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.","status":"published","published":"2022-05-05T00:29:35Z","modified":"2023-02-10T05:06:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:02.310741Z"}],"nvd":[{"id":"CVE-2013-4225","description":"The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the \"access resource node\" and \"create page content\" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.","status":"published","published":"2020-02-11T21:15:10.83Z","modified":"2026-06-16T23:56:50.79Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-79","CWE-94"],"updated_at":"2026-11-02T14:02:52.934105Z"}],"osv":[{"id":"RHEA-2014:1175","title":"Red Hat Enhancement Advisory: Release of Satellite 6.0","status":"published","published":"2024-09-15T21:58:55Z","modified":"2026-10-07T10:01:18Z","updated_at":"2026-11-02T15:52:58.636919Z"}]}}