DRUPAL-CONTRIB-2020-015
This module enables you to build forms and surveys in Drupal.
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
5.11.0- Upgrade drupal/webform to this version or later
Description
This module enables you to build forms and surveys in Drupal.
The module doesn't sufficiently sanitize Webform labels nor visibility conditions under the scenario of placing a block. When a webform block is placed and visible on a website any JavaScript code contained within the webform's label was executed.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").
Affected versions
Packagist:https://packages.drupal.org/8
| Package | Vulnerable | Fixed in |
|---|---|---|
| drupal/webform | < 5.11.0 |
5.11.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
drupal/webform Packagist:https://packages.drupal.org/8 → 5.11.0
- composer
composer require drupal/webform:^5.11.0
References
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| DRUPAL-CONTRIB-2026-175 The Webform module allows site builders to create forms, collect submissions, and render submitted values in configurable formats. | Critical | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-174 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-173 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-172 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-171 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-170 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | High | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-169 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Medium | Also affects drupal/webform |
| DRUPAL-CONTRIB-2026-168 The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. | Low | Also affects drupal/webform |
Credits: Ide Braakman
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor