CVE-2015-4374
16.06.2015, 17:59
Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an email.
| Vendor | Product | Version |
|---|---|---|
| webform_project | webform | 𝑥 ≤ 6.x-3.3.22 |
| webform_project | webform | 7.x-3.0:x |
| webform_project | webform | 7.x-3.1:x |
| webform_project | webform | 7.x-3.2:x |
| webform_project | webform | 7.x-3.3:x |
| webform_project | webform | 7.x-3.4:x |
| webform_project | webform | 7.x-3.5:x |
| webform_project | webform | 7.x-3.6:x |
| webform_project | webform | 7.x-3.7:x |
| webform_project | webform | 7.x-3.8:x |
| webform_project | webform | 7.x-3.9:x |
| webform_project | webform | 7.x-3.10:x |
| webform_project | webform | 7.x-3.11:x |
| webform_project | webform | 7.x-3.12:x |
| webform_project | webform | 7.x-3.13:x |
| webform_project | webform | 7.x-3.14:x |
| webform_project | webform | 7.x-3.15:x |
| webform_project | webform | 7.x-3.16:x |
| webform_project | webform | 7.x-3.17:x |
| webform_project | webform | 7.x-3.18:x |
| webform_project | webform | 7.x-3.19:x |
| webform_project | webform | 7.x-3.20:x |
| webform_project | webform | 7.x-3.21:x |
| webform_project | webform | 7.x-3.22:x |
| webform_project | webform | 7.x-4.0:x |
| webform_project | webform | 7.x-4.1:x |
| webform_project | webform | 7.x-4.2:x |
| webform_project | webform | 7.x-4.3:x |
| webform_project | webform | 7.x-4.4:x |
𝑥
= Vulnerable software versions
References