Project: 
Webform
Project machine name: 
webform
Date: 
2020-May-06
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross site scripting
Affected versions: 
<5.11.0
Description: 

The Webform module allows site builders to create forms.

The module doesn't sufficiently prevent malicious code from being render via an options elements (i.e select menu, checkboxes, radios, etc...) under the scenario where the site builder allows the raw option value to be displayed.

This vulnerability is mitigated by the fact that site builder must be allowed to build webform and select raw as the options element's submission display.

Solution: 

Install the latest version:

Also see the Webform project page.

Reported By: 
Fixed By: 
Coordinated By: