CVE-2024-45440
Fixed upstream EPSS 9%CVSS 5.3
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
Products: Drupal Core, drupal
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | drupal/core | 10.3.6 |
| Packagist | drupal/core | 11.0.5 |
| Packagist | drupal/core | 10.2.9 |
| Packagist | drupal/core-recommended | 10.3.6 |
| Packagist | drupal/core-recommended | 11.0.5 |
| Packagist | drupal/core-recommended | 10.2.9 |
| Packagist | drupal/drupal | 10.3.6 |
| Packagist | drupal/drupal | 11.0.5 |
| Packagist | drupal/drupal | 10.2.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu Pro 14.04 LTS | drupal7 | no fix |
| Ubuntu Pro 16.04 LTS | drupal7 | no fix |