CVE-2024-13255 RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019

What is CVE-2024-13255?

CVE-2024-13255 is a high-severity vulnerability in Drupal RESTful Web Services, published on 9 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.

Weakness: CWE-202

Which versions are affected by CVE-2024-13255?

It affects 1 product.

Products include Restful Web Services Project Restful Web Services.

How do I fix CVE-2024-13255?

No fix has been published for CVE-2024-13255 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-13255 being exploited?

There is no known exploitation of CVE-2024-13255 in the wild and no public exploit code.

Other vulnerabilities in Drupal RESTful Web Services

• CVE-2013-4225 Code injection in RESTful Web Services High 8.8
• CVE-2013-0205 Cross-site request forgery in n/a Medium 6.8
• CVE-2012-5556 Cross-site request forgery in n/a Medium 6.8
• CVE-2015-4345 Information disclosure in n/a Medium 5.0
• CVE-2013-1946 Denial of service in n/a Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jf66-v4fg-qpqx.