CVE-2024-13255

CVE-2024-13255 is an Exposure of Sensitive Information Through Data Queries vulnerability in the Drupal RESTful Web Services module, enabling forceful browsing. This issue affects RESTful Web Services versions from 7.X-2.0 before 7.X-2.10. The vulnerability is classified under CWE-202 and has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no effect on integrity or availability.

Remote attackers require only network access and can exploit the vulnerability without privileges or user interaction due to its low attack complexity. Successful exploitation allows disclosure of sensitive information through crafted data queries targeting the RESTful endpoints.

The Drupal security advisory at https://www.drupal.org/sa-contrib-2024-019 details mitigation steps, with the issue resolved in RESTful Web Services version 7.X-2.10. Site administrators should update to this or later versions to address the vulnerability.