Drupal Webform Module HTML Injection and Information Disclosure Vulnerabilities

Drupal is a web-based content manager. Webform is a Drupal module that is used to create questionnaires, contact forms, surveys, and other forms. The application is exposed to an HTML injection issue because the application fails to sufficiently sanitize user-supplied input passed through field labels, and an information disclosure issue because the application use token placeholders for a default value in a page cache. Webform version 6.x-2.8 and 5.x-2.8 are affected by this issue.

Ref: http://drupal.org/node/604942

09.44.89 - CVE: Not Available
Platform: Web Application