Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2015-4356: Drupal Webform module lets certain users run scripts
CVE-2015-4356 · published 11 years ago
Summary
The Webform add‑on for Drupal versions 7.x‑4.x prior to 7.x‑4.4 lets users who can view form results insert their own JavaScript or HTML. That code runs in the browsers of anyone who later looks at the results table, potentially stealing data or hijacking sessions. Upgrade the Webform module to 7.x‑4.4 or later and review user permissions to limit who can view results.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| webform_project | webform |
7.x-4.0 7.x-4.1 7.x-4.2 7.x-4.3 cpe:2.3:a:webform_project:webform:7.x-4.0:*:*:*:*:drupal:*:* |
Original advisory text
Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions t...
Cross-site scripting (XSS) vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
3.5
Low
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Jun 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-4356 · NVD
Track software like this
Free during beta