Description
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Drupal | Drupal core | v11.x-dev | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | drupal7 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | drupal7 | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- Drupal 11.x-dev - Full Path Disclosure EDB-52266 · webapps · Apr 19, 2025
GitHub 2 repositories
-
w0r1i0g1ht/CVE-2024-45440 ★ 2 · Dec 26, 2024
Drupal CVE-2024-45440
-
zoomdbz/CVE-2024-45440 ★ 1 · Feb 10, 2026
Enumeration tool for CVE-2024-45440
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Drupal 11.x-dev - Full Path Disclosure http/cves/2024/CVE-2024-45440.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | drupal/core | >= 10.3.0, < 10.3.6 | 10.3.6 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/core | >= 11.0.0, < 11.0.5 | 11.0.5 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/core | >= 8.0.0, < 10.2.9 | 10.2.9 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/core-recommended | >= 10.3.0, < 10.3.6 | 10.3.6 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/core-recommended | >= 11.0.0, < 11.0.5 | 11.0.5 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/core-recommended | >= 8.0.0, < 10.2.9 | 10.2.9 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/drupal | >= 10.3.0, < 10.3.6 | 10.3.6 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/drupal | >= 11.0.0, < 11.0.5 | 11.0.5 | GHSA-mg8j-w93w-xjgc |
| Packagist | drupal/drupal | >= 8.0.0, < 10.2.9 | 10.2.9 | GHSA-mg8j-w93w-xjgc |