The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule c...

Webform Entity Print does not sufficiently restrict access to its print templates, allowing cross-site scripting (XSS) through its settings. The submodule must be enabled, and the attacker must have both the create webform and edit own webform permissions.

Look for drupal/webform and its installed version in composer.lock. The advisory lists fixes in 6.2.12 and 6.3.1, but gives no affected version ranges. Check whether Webform Entity Print is enabled and whether any user role has both create webform and edit own webform permissions.

The advisory says the vulnerability is mitigated by requiring both the create webform and edit own webform permissions, as well as the Webform Entity Print module being enabled.

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data.

Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user with permissions to create a webform can exploit cross-site scripting (XSS) in submodule settings.

This vulnerability is mitigated by the fact that an attacker must have a role with create webform and edit own webform permissions, and the Webform Entity Print module must be enabled.