CVE-2024-45440

Published: Aug 29, 2024Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Affected (1)

Products: Drupal: Drupal

Drupal

1 product

Drupal

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Drupal Drupal	Version 2023-05-09

Related CWEs

CWE-209

Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

References (3)

https://senscybersecurity.nl/CVE-2024-45440-Explained/

Source: mlhess@drupal.org

Third Party Advisory

https://www.drupal.org/project/drupal/issues/3457781

Source: mlhess@drupal.org

Vendor Advisory

https://www.exploit-db.com/exploits/52266

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.