GHSA-p745-347h-hjfwmedium4.3
Drupal sensitive information disclosure
Impact
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/core Packagist
| Affected range | Recorded fix |
|---|---|
| From 7.0 before 7.52Ecosystem versions | 7.52 |
| From 8.0 before 8.2.3Ecosystem versions | 8.2.3 |
Version evidence: OSV · GHSA-p745-347h-hjfw
View original version evidence (44 explicit versions)
drupal/drupal Packagist
| Affected range | Recorded fix |
|---|---|
| From 8.0 before 8.2.3Ecosystem versions | 8.2.3 |
| From 7.0 before 7.52Ecosystem versions | 7.52 |
Version evidence: OSV · GHSA-p745-347h-hjfw
View original version evidence (50 explicit versions)
Original source description
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2016-9449
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yaml
- Source reference github.com/drupal/core
- Security advisory www.drupal.org/SA-CORE-2016-005
- Security advisory www.debian.org/security/2016/dsa-3718
- Source reference www.securityfocus.com/bid/94367