CVE:CVE-2009-4533
CNNVD:CNNVD-200912-452
Drupal Webform模块5.x-2.8之前的5.x和6.x-2.8之前的6.x没有阻止对包含默认值的令牌站位的网页的隐藏，这使得远程攻击者可以借助未明向量，读取会话变量。
solution:Upgrade nathan_haug webform to a higher version than 5.x-2.7,6.x-2.7,5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.8,5.x-1.9,5.x-1.10,5.x-1.x-dev,5.x-2.0,5.x-2.0-beta0,5.x-2.0-beta1,5.x-2.0-beta2,5.x-2.0-beta3,5.x-2.1,5.x-2.1.1,5.x-2.1.2,5.x-2.1.3,5.x-2.2,5.x-2.3,5.x-2.4,5.x-2.5,5.x-2.6,5.x-2.x-dev,6.x-2.0-beta1,6.x-2.0-beta2,6.x-2.0-beta3,6.x-2.0-beta4,6.x-2.0-beta5,6.x-2.0-beta6,6.x-2.1,6.x-2.1-1,6.x-2.1.2,6.x-2.1.3,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6,6.x-2.x-dev,and avoid the version (,5.x-2.7],(,6.x-2.7],5.x-1.2,5.x-1.3,5.x-1.4,5.x-1.5,5.x-1.6,5.x-1.7,5.x-1.8,5.x-1.9,5.x-1.10,5.x-1.x-dev,5.x-2.0,5.x-2.0-beta0,5.x-2.0-beta1,5.x-2.0-beta2,5.x-2.0-beta3,5.x-2.1,5.x-2.1.1,5.x-2.1.2,5.x-2.1.3,5.x-2.2,5.x-2.3,5.x-2.4,5.x-2.5,5.x-2.6,5.x-2.x-dev,6.x-2.0-beta1,6.x-2.0-beta2,6.x-2.0-beta3,6.x-2.0-beta4,6.x-2.0-beta5,6.x-2.0-beta6,6.x-2.1,6.x-2.1-1,6.x-2.1.2,6.x-2.1.3,6.x-2.2,6.x-2.3,6.x-2.4,6.x-2.5,6.x-2.6,6.x-2.x-dev