# DRUPAL-CONTRIB-2020-010 - This module provides a JSON API standards-compliant API for accessing and manipulating…

Source: https://junglewise.ai/threats/drupal-contrib-2020-010-this-module-provides-a-json-api-standards-ad2e99b1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-04-15  
License: CC BY 4.0 with a link back

Severity: info · Published 2020-04-15

This module provides a JSON API standards-compliant API for accessing and  
manipulating Drupal content and configuration entities.

The security team and module maintainers are marking this project unsupported. Both the `8.x-1.x` and `8.x-2.x` versions are unsupported, and users of either version are strongly encouraged to upgrade to a supported version of Drupal core, which includes a supported version of JSON:API.

The eventual removal of security coverage for the JSON:API contributed module was [announced with the release of JSON:API 8.x-1.22](https://www.drupal.org/project/jsonapi/releases/8.x-1.22) on 28 June 2018.

Additionally, there is a known security issue with the 8.x-1.x branch of the project that will not be fixed by the maintainers. That issue is not present in the 8.x-2.x branch of the project, nor is it present in Drupal core.

Technologies: [Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi](https://junglewise.ai/threats/technologies/drupal-jsonapi). Vendors: [Packagist:Https://Packages.Drupal.Org/8](https://junglewise.ai/threats/vendors/packagist-https-packages-drupal-org-8).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 15 April 2020.

**Which products and versions are affected?** Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi ECOSYSTEM:introduced=0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected?** Check whether you run Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Packagist:Https://Packages.Drupal.Org/8 Drupal/Jsonapi ECOSYSTEM:introduced=0

## Related threats

- [DRUPAL-CONTRIB-2019-019 - This resolves issues described in [SA-CORE-2019-003](https://www.drupal.org/sa-core-2019-003) for this module.](https://junglewise.ai/threats/drupal-contrib-2019-019-this-resolves-issues-described-in-sa-core-2019-e82562bb)
- [DRUPAL-CONTRIB-2018-081 - This module provides a JSON:API specification-compliant HTTP API for accessing and manipulating Drupal content and configuration entities.](https://junglewise.ai/threats/drupal-contrib-2018-081-this-module-provides-a-json-api-specification-dccd2cf8)
- [DRUPAL-CONTRIB-2018-021 - This module provides a JSON API standards-compliant API for accessing and manipulating…](https://junglewise.ai/threats/drupal-contrib-2018-021-this-module-provides-a-json-api-standards-2697650f)
- [DRUPAL-CONTRIB-2018-016 - This module provides a JSON API standards-compliant API for accessing and manipulating…](https://junglewise.ai/threats/drupal-contrib-2018-016-this-module-provides-a-json-api-standards-86bba8de)
- [DRUPAL-CONTRIB-2018-015 - This module provides a JSON API standards-compliant API for accessing and manipulating…](https://junglewise.ai/threats/drupal-contrib-2018-015-this-module-provides-a-json-api-standards-473bf0d5)