DRUPAL-CONTRIB-2018-081

    Dashboard / Vulnerabilities / DRUPAL-CONTRIB-2018-081

    DRUPAL-CONTRIB-2018-081

    Published: 19 Dec 2018Last Modified: 10 Sept 2026

    Summary:

    Details: This module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities. The module doesn't sufficiently check access when responding to certain filtered collection requests, thereby causing an access bypass vulnerability. (This means certain `GET` requests are vulnerable; no `POST`, `PATCH` or `DELETE` requests are vulnerable.) In order to fix this issue, two new hooks were added: `hook_jsonapi_ENTITY_TYPE_filter_access()` and `hook_jsonapi_entity_field_filter_access()`. Sites with custom entity types and/or with entity or field access customizations may need to implement these newly introduced hooks.

    References: https://www.drupal.org/sa-contrib-2018-081

    Affected packages

    Package

    Name: drupal/jsonapi

    Purl: pkg:composer/drupal/jsonapi?repository_url=https:%2F%2Fpackages.drupal.org%2F8

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.24.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DRUPAL-CONTRIB-2018-081 | CVE-DB