Description
The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote attackers to read session variables via unspecified vectors.
References
- 36708 vdb-entry
- 37021 third-party-advisory
- ADV-2009-2923 vdb-entry
- http://drupal.org/node/604920
- http://drupal.org/node/604942
- http://drupal.org/node/604922
- 58946 vdb-entry
- drupal-webform-cache-info-disclosure(53797) vdb-entry