Description
The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms.
References (4)
Core 4
Core References
Patch, Vendor Advisory x_refsource_misc
http://drupal.org/node/1834868
Patch x_refsource_confirm
http://drupal.org/node/1774252
Various Sources x_refsource_misc
http://drupal.org/node/1768632
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/11/20/4
Scores
EPSS
0.0137
EPSS Percentile
68.6%
Details
CWE
CWE-200
Status
published
Products (3)
coleman_watts/webform_civicrm
7.x-3.0 (10 CPE variants)
coleman_watts/webform_civicrm
7.x-3.1
coleman_watts/webform_civicrm
7.x-3.x dev
Published
Dec 03, 2012
Tracked Since
Feb 18, 2026