- Description
- core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
- Source
- mlhess@drupal.org
- NVD status
- Modified
CVSS 3.1
- Type
- Primary
- Base score
- 5.3
- Impact score
- 1.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
- Hype score
- Not currently trending
🚨 New PoC Alert: Drupal Information Disclosure Vulnerability 🚨 📛 CVE-2024-45440 🟠 CVSS: 5.3 📈 Impact: Information Disclosure 🛠️ TTPs: T1190 - Exploit Public-Facing Application 🔗 PoC: https://t.co/J2uapibprS thanks for docker file 😉 Patch Up! #infosec #cyber #security h
@gothburz
30 Dec 2024
25 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
#exploit 1. CVE-2024-45440: Drupal Full Path Disclosure https://t.co/tsmS6r2aQy 2. How an obscure PHP footgun led to RCE in Craft CMS https://t.co/HuvBH1x8aX 3. CVE-2024-20137: MediaTek SOCs WLAN Driver - DoS https://t.co/7Kyupv1n6L 4. CVE-2024-42845: InVesalius DICOM File… htt
@ksg93rd
28 Dec 2024
161 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:2023-05-09:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1AD01F6C-FF20-4D64-91BE-ABDF312E95F8"
}
],
"operator": "OR"
}
]
}
]