{
  "affected": [
    {
      "database_specific": {
        "affected_versions": "\u003c5.25.0 || 6.0.0 || 6.0.1"
      },
      "package": {
        "ecosystem": "Packagist:https://packages.drupal.org/8",
        "name": "drupal/webform"
      },
      "ranges": [
        {
          "database_specific": {
            "constraint": "\u003c5.25.0"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.25.0"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "6.0.0"
          },
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "last_affected": "6.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "database_specific": {
            "constraint": "6.0.1"
          },
          "events": [
            {
              "introduced": "6.0.1"
            },
            {
              "last_affected": "6.0.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": []
    }
  ],
  "aliases": [],
  "credits": [
    {
      "contact": [
        "https://www.drupal.org/user/787114"
      ],
      "name": "KarinG"
    }
  ],
  "details": "The [Webform module for Drupal 8/9](https://www.drupal.org/project/webform) includes a default Contact webform, which sends a notification email to the site owner and a confirmation email to the email address supplied via the form.\n\nThe confirmation email can be used as an open mail relay to send an email to any email address.\n\nThis vulnerability is mitigated by the fact that the site owner\u0027s email address is also receiving a notification email, which should alert the site owner to the exploitation. If the site owner\u0027s mailbox is not monitored, the open mail relay can be more easily exploited.\n\nWith the Webform module\u0027s latest release, the default Contact\u0027s confirmation email will only be sent to an authenticated user\u0027s email address. Anonymous users will no longer receive a confirmation email.\n\nIf anonymous users need to receive a confirmation email, we recommend you add SPAM protection to the form and update the email handler.",
  "id": "DRUPAL-CONTRIB-2021-004",
  "modified": "2023-08-11T17:15:22.000Z",
  "published": "2021-03-03T16:49:33.000Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.drupal.org/sa-contrib-2021-004"
    }
  ],
  "schema_version": "1.7.0"
}