SA-CONTRIB-2014-108 - Webform Component Roles - Access Bypass

The Webform component module enables site admins to limit visibility or editability of webform components based on user roles.

The module doesn’t sufficiently check that disabled component values are not modified upon submission of the form.

CVE identifier(s) issued

• CVE-2014-9022

Versions affected

• Webform Component Roles 6.x-1.x versions prior to 6.x-1.8.
• Webform Component Roles 7.x-1.x versions prior to 7.x-1.8.

Drupal core is not affected. If you do not use the contributed Webform Component Roles module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Webform Component Roles module for Drupal 6.x, upgrade to Webform Component Roles 6.x-1.8
• If you use the Webform Component Roles module for Drupal 7.x, upgrade to Webform Component Roles 7.x-1.8

Also see the Webform Component Roles project page.

Reported by

• Colleen Blaho

Fixed by

• Shawn Sheridan the module maintainer

Coordinated by

• David Rothstein of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team