CVE-2016-9449
Drupal sensitive information disclosure
CVE-2016-9449 is a medium vulnerability (CVSS 4.3) in Drupal, published November 17, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in drupal/core 7.52.
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
- Record
CVE-2016-9449- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
- Record
CVE-2016-9449- Updated
- 2026-11-02
EUVDEUVD-2022-4701 No score
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
- Record
EUVD-2022-4701- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p745-347h-hjfw
Drupal sensitive information disclosure
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
- Record
GHSA-p745-347h-hjfw- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
- Record
CVE-2016-9449- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-p745-347h-hjfw
Drupal sensitive information disclosure
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
- Record
GHSA-p745-347h-hjfw- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-9449
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
- Record
UBUNTU-CVE-2016-9449- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0413 No score
Updated drupal packages fix security vulnerability
Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users (CVE-2016-9449).
Confirmation forms allow external URLs to be injected (CVE-2016-9451).
- Record
MGASA-2016-0413- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/corePackagist |
7.0 up to 7.52 | 7.52 |
drupal/corePackagist |
8.0 up to 8.2.3 | 8.2.3 |
drupal/drupalPackagist |
8.0 up to 8.2.3 | 8.2.3 |
drupal/drupalPackagist |
7.0 up to 7.52 | 7.52 |
drupal7Debian:7 |
before 7.14-2+deb7u15, plus listed versions 7.14-27.14-2+deb7u17.14-2+deb7u107.14-2+deb7u10~bpo60+17.14-2+deb7u11 Show 18 moreShow less7.14-2+deb7u11~bpo60+17.14-2+deb7u127.14-2+deb7u137.14-2+deb7u147.14-2+deb7u1~bpo60+17.14-2+deb7u27.14-2+deb7u2~bpo60+17.14-2+deb7u37.14-2+deb7u47.14-2+deb7u4~bpo60+17.14-2+deb7u57.14-2+deb7u67.14-2+deb7u6~bpo60+17.14-2+deb7u77.14-2+deb7u7~bpo60+17.14-2+deb7u87.14-2+deb7u97.14-2+deb7u9~bpo60+1 |
7.14-2+deb7u15 |
drupal7Debian:8 |
before 7.32-1+deb8u8, plus listed versions 7.32-1+deb8u37.32-1+deb8u47.32-1+deb8u4~bpo70+17.32-1+deb8u57.32-1+deb8u5~bpo70+17.32-1+deb8u67.32-1+deb8u7 |
7.32-1+deb8u8 |
drupal/corePackagist |
8.0 up to 8.2.3, plus listed versions 8.0.08.0.0-beta108.0.0-beta118.0.0-beta128.0.0-beta13 Show 39 moreShow less8.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta68.0.0-beta78.0.0-beta88.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.2 |
8.2.3 |
drupal/drupalPackagist |
8.0 up to 8.2.3, plus listed versions 8.0.08.0.0-alpha148.0.0-alpha158.0.0-beta18.0.0-beta10 Show 45 moreShow less8.0.0-beta118.0.0-beta128.0.0-beta138.0.0-beta148.0.0-beta158.0.0-beta168.0.0-beta28.0.0-beta38.0.0-beta48.0.0-beta58.0.0-beta68.0.0-beta78.0.0-beta98.0.0-rc18.0.0-rc28.0.0-rc38.0.0-rc48.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.48.1.58.1.68.1.78.1.88.1.98.2.08.2.0-beta18.2.0-beta28.2.0-beta38.2.0-rc18.2.0-rc28.2.18.2.2 |
8.2.3 |
drupalMageia:5 |
before 7.52-1.mga5 | 7.52-1.mga5 |
drupal7Ubuntu:Pro:14.04:LTS |
All versions, plus listed versions 7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3 |
None known |
drupal7Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
debian.org/security/2016/dsa-3718
securityfocus.com/bid/94367
drupal.org/SA-CORE-2016-005
nvd.nist.gov/vuln/detail/CVE-2016-9449
github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml
Show 26 moreShow less
advisories.mageia.org/MGASA-2016-0413.html
bugs.mageia.org/show_bug.cgi?id=19812
openwall.com/lists/oss-security/2016/11/18/16
lwn.net/Vulnerabilities/707038
ubuntu.com/security/CVE-2016-9449
openwall.com/lists/oss-security/2016/11/18/8
cve.org/CVERecord?id=CVE-2016-9449