Project: 
Universally Unique IDentifier
Date: 
2018-July-04
Security risk: 
Moderately critical 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon
Vulnerability: 
Arbitrary file upload
Description: 

This module provides an API for adding universally unique identifiers (UUID) to Drupal objects, most notably entities.

The module module has an arbitrary file upload vulnerability when it's used in combination with the services REST server.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to allow to upload to the file create REST endpoint.

Solution: 
  • If you use the uuid module for Drupal 7.x, upgrade to uuid 7.x-1.1

    • Also see the Universally Unique IDentifier project page

    Reported By: 
    Fixed By: 
    Coordinated By: