Webform Module for Drupal contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered as the module does not prevent the page from being cached when a default value uses token placeholders, which will disclose session variable information to a remote attacker.
Classification
Location:
Remote / Network Access
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Solution:
Upgrade
Disclosure:
Vendor Verified
OSVDB:
Web Related
Solution
Upgrade to version 5.x-2.8, 6.x-2.8, or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
