CVE-2016-9449

MEDIUM

Drupal 7.x < 7.52 and 8.x < 8.2.3 - Authenticated Sensitive Information Exposure via Taxonomy Module

Title source: llm
STIX 2.1

Description

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.

References (3)

Core 3
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3718
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94367
Patch, Vendor Advisory x_refsource_confirm
https://www.drupal.org/SA-CORE-2016-005

Scores

CVSS v3 4.3
EPSS 0.0022
EPSS Percentile 43.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200
Status published
Products (15)
drupal/core 7.0 - 7.52Packagist
drupal/drupal 8.0.0 (33 CPE variants)
drupal/drupal 8.0.1
drupal/drupal 8.0.2
drupal/drupal 8.0.3
drupal/drupal 8.0.4
drupal/drupal 8.0.5
drupal/drupal 8.0.6
drupal/drupal 8.1.0 (4 CPE variants)
drupal/drupal 8.1.1
... and 5 more
Published Nov 25, 2016
Tracked Since Feb 18, 2026