# DRUPAL-CONTRIB-2018-021 - This module provides a JSON API standards-compliant API for accessing and manipulating…

Source: https://junglewise.ai/threats/drupal-contrib-2018-021-this-module-provides-a-json-api-standards-2697650f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-04-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2018-04-25

This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities.

The module doesn't provide CSRF protection when processing authenticated traffic using cookie-based authentication.

This vulnerability is mitigated by the fact that an attacker must be allowed to create or modify entities of a certain type, and a very specific and uncommon CORS configuration that allows all other pre-checks to be skipped.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi](https://junglewise.ai/threats/technologies/drupal-jsonapi). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 25 April 2018.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi ECOSYSTEM:introduced=0,fixed=1.16.0.

**Is there a fix for This vulnerability?** Yes. Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi: upgrade to 1.16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi: upgrade to 1.16.0 or later

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi ECOSYSTEM:introduced=0,fixed=1.16.0

## Related threats

- [DRUPAL-CONTRIB-2020-010 - This module provides a JSON API standards-compliant API for accessing and manipulating…](https://junglewise.ai/threats/drupal-contrib-2020-010-this-module-provides-a-json-api-standards-ad2e99b1)
- [DRUPAL-CONTRIB-2019-019 - This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module.](https://junglewise.ai/threats/drupal-contrib-2019-019-this-resolves-issues-described-in-sa-core-2019-e82562bb)
- [DRUPAL-CONTRIB-2018-081 - This module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities.](https://junglewise.ai/threats/drupal-contrib-2018-081-this-module-provides-a-json-api-specification-dccd2cf8)
- [DRUPAL-CONTRIB-2018-016 - This module provides a JSON API standards-compliant API for accessing and manipulating…](https://junglewise.ai/threats/drupal-contrib-2018-016-this-module-provides-a-json-api-standards-86bba8de)
- [DRUPAL-CONTRIB-2018-015 - This module provides a JSON API standards-compliant API for accessing and manipulating…](https://junglewise.ai/threats/drupal-contrib-2018-015-this-module-provides-a-json-api-standards-473bf0d5)