Default configuration

2012-12-0321:55:00

PRIOn knowledge base

www.prio-n.com

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

57.6%

JSON

The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has “Enforce Permissions” disabled, which allows remote attackers to obtain contact information by reading webforms.

CPENameOperatorVersion
webform_civicrmeq7.x-3.0 rc4
webform_civicrmeq7.x-3.0 beta3
webform_civicrmeq7.x-3.0 beta1
webform_civicrmeq7.x-3.0 rc1
webform_civicrmeq7.x-3.0 beta4
webform_civicrmeq7.120.30
webform_civicrmeq7.x-3.0 beta2
webform_civicrmeq7.x-3.0 rc3
webform_civicrmeq7.x-3.0 rc2
webform_civicrmeq7.x-3.0 beta5

Name	Operator	Version
webform_civicrm	eq	7.x-3.0 rc4
webform_civicrm	eq	7.x-3.0 beta3
webform_civicrm	eq	7.x-3.0 beta1
webform_civicrm	eq	7.x-3.0 rc1
webform_civicrm	eq	7.x-3.0 beta4
webform_civicrm	eq	7.120.30
webform_civicrm	eq	7.x-3.0 beta2
webform_civicrm	eq	7.x-3.0 rc3
webform_civicrm	eq	7.x-3.0 rc2
webform_civicrm	eq	7.x-3.0 beta5