{"answers":{"affected":"","exploited":"There is no known exploitation of DRUPAL-CONTRIB-2021-004 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"DRUPAL-CONTRIB-2021-004 is a vulnerability in drupal/webform, published on 3 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for DRUPAL-CONTRIB-2021-004 and fix it if it is affected.\n\nWhat it is: DRUPAL-CONTRIB-2021-004 is a vulnerability in drupal/webform, published on 3 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of DRUPAL-CONTRIB-2021-004 in the wild and no public exploit code.\n\nAffected product: drupal/webform. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/DRUPAL-CONTRIB-2021-004/ (Markdown: https://insights.sbomify.com/DRUPAL-CONTRIB-2021-004/index.md)","id":"DRUPAL-CONTRIB-2021-004","markdown":"https://insights.sbomify.com/DRUPAL-CONTRIB-2021-004/index.md","name":"DRUPAL-CONTRIB-2021-004","record":{"aliases":[],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["other"],"network_reachable":"yes","non_default_config":false,"product_category":"Drupal Webform module","requires_auth":"none","summary":"An open mail relay vulnerability in the Drupal Webform module allows attackers to send emails to arbitrary addresses via the default contact form.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form.\n\nThe confirmation email can be used as an open mail relay to send an email to any email address.\n\nThis vulnerability is mitigated by the fact that the site owner's email address is also receiving a notification email, which should alert the site owner to the exploitation. If the site owner's mailbox is not monitored, the open mail relay can be more easily exploited.\n\nWith the Webform module's latest release, the default Contact's confirmation email will only be sent to an authenticated user's email address. Anonymous users will no longer receive a confirmation email.\n\nIf anonymous users need to receive a confirmation email, we recommend you add SPAM protection to the form and update the email handler.","ecosystems":["Packagist:https://packages.drupal.org/8"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which sends a notification e","id":"DRUPAL-CONTRIB-2021-004","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"other","year":"2021"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"Packagist:https://packages.drupal.org/8","fixed":["5.25.0"],"introduced":["0","6.0.0","6.0.1"],"last_affected":["6.0.0","6.0.1"],"package":"drupal/webform","purl":"pkg:composer/drupal/webform?repository_url=https:%2F%2Fpackages.drupal.org%2F8","source":"DRUPAL-CONTRIB-2021-004"}],"products":null,"published":"2021-03-03","related":[],"sources":[{"class":"attribution","licence":"MIT","name":"Drupal","prefix":"DRUPAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An open mail relay vulnerability in the Drupal Webform module allows attackers to send emails to arbitrary addresses via the default contact form.","url":"https://insights.sbomify.com/DRUPAL-CONTRIB-2021-004/"}