CVE-2024-45440

Summary

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://www.exploit-db.com/exploits/52266

References

• https://www.drupal.org/project/drupal/issues/3457781
• https://senscybersecurity.nl/CVE-2024-45440-Explained/

• ←Previous
• Next→