CVE-2013-4225: Restful Web Services Project Restful Web Services

High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days.

The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions (or equivalents) to conduct cross-site scripting (XSS) or execute arbitrary PHP code via a crafted text field.

Affected products

• Restful Web Services Project Restful Web Services: from 7.x-1.0, before 7.x-1.4 (fixed in 7.x-1.4); from 7.x-2.0, before 7.x-2.1 (fixed in 7.x-2.1); version 7.x-2.x only

Published 2020-02-11. Last modified 2026-06-16.