Rest Json Api Authentication For Drupal
Monthly
An authentication bypass in the contributed Drupal module 'REST & JSON API Authentication' (versions 0.0.0 through 3.2.0) allows remote attackers to reach REST/JSON API functionality that should be gated behind the module's authentication, with low confidentiality and integrity impact and no availability impact. Only Drupal sites that have deliberately installed and enabled this optional contrib module - and exposed its API endpoints over the network - are in scope; Drupal core and sites without the module are unaffected. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N for a base score of 6.5, EPSS is 0.18% (7th percentile) and there is no CISA KEV listing, so this is a moderate-priority item; no public exploit code has been identified at time of analysis. A vendor fix is available per the Drupal advisory, and the item is prioritized as 'this_month'.
An authentication bypass in the contributed Drupal module 'REST & JSON API Authentication' (versions 0.0.0 through 3.2.0) allows remote attackers to reach REST/JSON API functionality that should be gated behind the module's authentication, with low confidentiality and integrity impact and no availability impact. Only Drupal sites that have deliberately installed and enabled this optional contrib module - and exposed its API endpoints over the network - are in scope; Drupal core and sites without the module are unaffected. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N for a base score of 6.5, EPSS is 0.18% (7th percentile) and there is no CISA KEV listing, so this is a moderate-priority item; no public exploit code has been identified at time of analysis. A vendor fix is available per the Drupal advisory, and the item is prioritized as 'this_month'.