GitHub Advisoryadvisory · Packagist

GHSA-p745-347h-hjfw Drupal sensitive information disclosure

MEDIUM Published 2022-05-17 Modified 2024-04-23 Official page ↗
Aliases
CVE-2016-9449
Ecosystem
Packagist
Packages
drupal/core, drupal/drupal
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-04-23

Affected packages

• Packagist drupal/core: >= 7.0, < 7.52 → fixed in 7.52 • Packagist drupal/core: >= 8.0, < 8.2.3 → fixed in 8.2.3 • Packagist drupal/drupal: >= 8.0, < 8.2.3 → fixed in 8.2.3 • Packagist drupal/drupal: >= 7.0, < 7.52 → fixed in 7.52

Description

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.

Related

Alias · CVE (1)

  • CVE-2016-9449 The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References