DRUPAL-CONTRIB-2020-014
This module enables you to build forms and surveys in Drupal.
The module doesn't sufficiently filter user input under in the scenario when a webform is edited, namely the message related to character min/max counter does not undergo sufficient filtering and thus allows execution of JavaScript code through it.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").
What each source reports
OSV No score
This module enables you to build forms and surveys in Drupal.
The module doesn't sufficiently filter user input under in the scenario when a webform is edited, namely the message related to character min/max counter does not undergo sufficient filtering and thus allows execution of JavaScript code through it.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").
- Record
DRUPAL-CONTRIB-2020-014- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/webformPackagist:https://packages.drupal.org/8 |
before 5.11.0 | 5.11.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2020-014 is a vulnerability with no CVSS score yet in drupal/webform, published May 6, 2020. No source lists public exploit code. Fixed in drupal/webform 5.11.0.