Skip to content
OpenAdvisories
Medium · 4.3 CVE-2016-9449 EUVD-2022-4701GHSA-p745-347h-hjfw

Drupal sensitive information disclosure

Published Nov 25, 2016 · Updated Aug 6, 2024 · Assigned by mitre

Description

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 8 drupal7 7.32-1+deb8u8 DSA-3718-1
Debian 7 drupal7 7.14-2+deb7u15 DLA-715-1
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS drupal7 No fix yet —
Ubuntu Pro 14.04 LTS drupal7 No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist drupal/core >= 7.0, < 7.52 7.52 GHSA-p745-347h-hjfw
Packagist drupal/core >= 8.0, < 8.2.3 8.2.3 GHSA-p745-347h-hjfw
Packagist drupal/drupal >= 8.0, < 8.2.3 8.2.3 GHSA-p745-347h-hjfw
Packagist drupal/drupal >= 7.0, < 7.52 7.52 GHSA-p745-347h-hjfw

Advisories 2

References