GHSA-p745-347h-hjfw
Drupal sensitive information disclosure
At a glance
- Published
- Updated
- CVE
- CVE-2016-9449
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
Affected packages
| Package | Versions |
|---|---|
| Packagist · drupal/core | introduced 7.0, fixed 7.52 |
| Packagist · drupal/core | introduced 8.0, fixed 8.2.3 |
| Packagist · drupal/drupal | introduced 8.0, fixed 8.2.3 |
| Packagist · drupal/drupal | introduced 7.0, fixed 7.52 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-9449 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yaml WEB
- https://github.com/drupal/core PACKAGE
- https://www.drupal.org/SA-CORE-2016-005 WEB
- http://www.debian.org/security/2016/dsa-3718 WEB
- http://www.securityfocus.com/bid/94367 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |