DRUPAL-CONTRIB-2020-015
This module enables you to build forms and surveys in Drupal.
The module doesn't sufficiently sanitize Webform labels nor visibility conditions under the scenario of placing a block. When a webform block is placed and visible on a website any JavaScript code contained within the webform's label was executed.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").
What each source reports
OSV No score
This module enables you to build forms and surveys in Drupal.
The module doesn't sufficiently sanitize Webform labels nor visibility conditions under the scenario of placing a block. When a webform block is placed and visible on a website any JavaScript code contained within the webform's label was executed.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform").
- Record
DRUPAL-CONTRIB-2020-015- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/webformPackagist:https://packages.drupal.org/8 |
before 5.11.0 | 5.11.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2020-015 is a vulnerability with no CVSS score yet in drupal/webform, published May 6, 2020. No source lists public exploit code. Fixed in drupal/webform 5.11.0.