CVE-2013-4225: The RESTful Web Services (restws) module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does...

Security readout for executives and security teams

This issue affects Drupal sites using the RESTful Web Services module. Certain authenticated users with content/resource permissions could write crafted text fields that cause cross-site scripting or, in some cases, arbitrary PHP execution. It is not Drupal core, but it can become serious where exposed sites grant broad content creation permissions. Exposure is limited to Drupal deployments with the RestWS module on affected 7.x branches, especially where non-admin users have node resource access and page creation permissions. Public internet exposure increases business risk, but authentication and specific permissions are required. Prioritize remediation for public Drupal sites or sites with many content contributors. The required authentication lowers mass-exploitation likelihood, but the possible PHP execution impact makes this a high-priority module upgrade and permissions review. Mitigation focus: Upgrade RestWS 7.x-1.x to 7.x-1.4 or later.; Upgrade RestWS 7.x-2.x to 7.x-2.1 or later.; Restrict "access resource node" and content creation permissions to trusted roles..

Prepared

Jun 6, 2026, 02:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.