CVE-2024-45440

MEDIUM severity · CVSS 5.3 · Information disclosure

5.3CVSS MEDIUM

Summary

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactLow

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)87%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products we track (1)

Drupal

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://www.drupal.org/project/drupal/issues/3457781Advisory
https://senscybersecurity.nl/CVE-2024-45440-Explained/Advisory
https://www.exploit-db.com/exploits/52266