Drupal sensitive information disclosure
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-9449US | medium4.3 | — | ||
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsi… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.debian.org/security/2016/dsa-3718WEB
- http://www.securityfocus.com/bid/94367WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yamlWEB
- https://github.com/drupal/corePACKAGE
- https://nvd.nist.gov/vuln/detail/CVE-2016-9449ADVISORY
- https://www.drupal.org/SA-CORE-2016-005WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan