GitHub Advisoryadvisory · Packagist

GHSA-mg8j-w93w-xjgc Drupal Full Path Disclosure

MEDIUM Published 2024-08-29 Modified 2025-04-23 Official page ↗
Aliases
CVE-2024-45440
Ecosystem
Packagist
Packages
drupal/drupal, drupal/core-recommended, drupal/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-209, CWE-497
Reviewed
2024-08-29

Affected packages

• Packagist drupal/drupal: >= 10.3.0, < 10.3.6 → fixed in 10.3.6 • Packagist drupal/drupal: >= 11.0.0, < 11.0.5 → fixed in 11.0.5 • Packagist drupal/core-recommended: >= 10.3.0, < 10.3.6 → fixed in 10.3.6 • Packagist drupal/core-recommended: >= 11.0.0, < 11.0.5 → fixed in 11.0.5 • Packagist drupal/core: >= 10.3.0, < 10.3.6 → fixed in 10.3.6 • Packagist drupal/core: >= 11.0.0, < 11.0.5 → fixed in 11.0.5 • Packagist drupal/drupal: >= 8.0.0, < 10.2.9 → fixed in 10.2.9 • Packagist drupal/core-recommended: >= 8.0.0, < 10.2.9 → fixed in 10.2.9 • Packagist drupal/core: >= 8.0.0, < 10.2.9 → fixed in 10.2.9

Description

`core/authorize.php` in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of `hash_salt` is `file_get_contents` of a file that does not exist.

Related

Alias · CVE (1)

  • CVE-2024-45440 core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is… vulnerability

Weakness · CWE (2)

  • CWE-209 Generation of Error Message Containing Sensitive Information weakness
  • CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere weakness

References