CVE-2024-45440

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Score

CVSS 3.1 5.3 Medium

Status

Modified - mlhess@drupal.org

Published

2024-08-29

Last modified

2025-04-21

Weaknesses

CWE-209

Affected products

• Drupal (Drupal)
• Drupal Core (Drupal)

References

• https://senscybersecurity.nl/CVE-2024-45440-Explained/
• https://www.drupal.org/project/drupal/issues/3457781
• https://www.exploit-db.com/exploits/52266