CVE-2015-4374

Published: Jun 16, 2015Modified: May 6, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient (To) address of an email.

Affected (29)

Products: Webform Project: Webform

Webform Project

1 product

Webform

Configuration A

29 vulnerable

Vulnerable Software	Affected Versions
Webform Project Webform	Up to 6.x-3.3.22
Webform Project Webform	Version 7.x-3.0
Webform Project Webform	Version 7.x-3.10
Webform Project Webform	Version 7.x-3.11
Webform Project Webform	Version 7.x-3.12
Webform Project Webform	Version 7.x-3.13
Webform Project Webform	Version 7.x-3.14
Webform Project Webform	Version 7.x-3.15
Webform Project Webform	Version 7.x-3.16
Webform Project Webform	Version 7.x-3.17
Webform Project Webform	Version 7.x-3.18
Webform Project Webform	Version 7.x-3.19
Webform Project Webform	Version 7.x-3.1
Webform Project Webform	Version 7.x-3.20
Webform Project Webform	Version 7.x-3.21
Webform Project Webform	Version 7.x-3.22
Webform Project Webform	Version 7.x-3.2
Webform Project Webform	Version 7.x-3.3
Webform Project Webform	Version 7.x-3.4
Webform Project Webform	Version 7.x-3.5
Webform Project Webform	Version 7.x-3.6
Webform Project Webform	Version 7.x-3.7
Webform Project Webform	Version 7.x-3.8
Webform Project Webform	Version 7.x-3.9
Webform Project Webform	Version 7.x-4.0
Webform Project Webform	Version 7.x-4.1
Webform Project Webform	Version 7.x-4.2
Webform Project Webform	Version 7.x-4.3
Webform Project Webform	Version 7.x-4.4