rest\/json vulnerabilities and fixes

Recent CVEs affecting rest\/json, with upgrade or downgrade steps. 8 tracked.

rest\/json has 8 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 8. Most recent: 2021-01-01. Highest priority: CVE-2016-20005 (score 57/100).

• CVE-2016-20008 HIGH 7.5 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows session enumeration, aka SA-CONTRIB-2016-033
• CVE-2016-20007 HIGH 7.5 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows session name guessing, aka SA-CONTRIB-2016-033
• CVE-2016-20006 HIGH 7.5 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows blockage of user logins, aka SA-CONTRIB-2016-033
• CVE-2016-20005 CRITICAL 9.8 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033
• CVE-2016-20004 CRITICAL 9.8 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows field access bypass, aka SA-CONTRIB-2016-033
• CVE-2016-20003 HIGH 7.5 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows user enumeration, aka SA-CONTRIB-2016-033
• CVE-2016-20002 CRITICAL 9.8 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows comment access bypass, aka SA-CONTRIB-2016-033
• CVE-2016-20001 CRITICAL 9.8 UPGRADE The REST/JSON project 7.x-1.x for Drupal allows node access bypass, aka SA-CONTRIB-2016-033

FAQ

How do I fix rest\/json vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is rest\/json being exploited right now?

None of the tracked rest\/json CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which rest\/json CVE should I patch first?

CVE-2016-20005 currently ranks highest (57/100): The REST/JSON project 7.x-1.x for Drupal allows user registration bypass, aka SA-CONTRIB-2016-033.

RSS feed for rest\/json · ← Back to latest CVEs