The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors.
References
Link | Resource |
---|---|
http://drupal.org/node/604920 | Patch |
http://drupal.org/node/604922 | Patch |
http://drupal.org/node/604942 | Patch Vendor Advisory |
http://osvdb.org/58946 | |
http://secunia.com/advisories/37021 | Vendor Advisory |
http://www.securityfocus.com/bid/36708 | |
http://www.vupen.com/english/advisories/2009/2923 | Vendor Advisory |
https://exchange.xforce.ibmcloud.com/vulnerabilities/53797 |
Configurations
Configuration 1 (hide)
AND |
|
History
No history.
Information
Published : 2009-12-31 19:30
Updated : 2024-02-28 11:41
NVD link : CVE-2009-4533
Mitre link : CVE-2009-4533
CVE.ORG link : CVE-2009-4533
JSON object : View
Products Affected
nathan_haug
- webform
drupal
- drupal
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor