CVE-2016-9449

MEDIUM

Drupal < 7.52 - Information Disclosure

Title source: rule

Description

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.

References (3)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/94367

[Patch, Vendor Advisory] https://www.drupal.org/SA-CORE-2016-005

[Third Party Advisory] http://www.debian.org/security/2016/dsa-3718

Scores

CVSS v3 4.3

EPSS 0.0022

EPSS Percentile 43.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (50)

drupal/drupal

... and 35 more

Timeline

Published Nov 25, 2016

Tracked Since Feb 18, 2026