Every CVE Search/ Get API key

CVE-2024-45440

Drupal core Denial of Service vulnerability

5.3 MediumPublic exploitFix available

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

9.27%Up 9.2 points since Aug 29, 2024
90%50%10%1%

What each source reports

NVD Score used 5.3

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Record
CVE-2024-45440
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
CVE List 5.3

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Record
CVE-2024-45440
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
EUVDEUVD-2024-2616 5.3

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Record
EUVD-2024-2616
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-mg8j-w93w-xjgc 6.3

Drupal Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Record
GHSA-mg8j-w93w-xjgc
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-209, CWE-497
Updated
2026-11-02
GitHub AdvisoriesGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02
OSVGHSA-mg8j-w93w-xjgc 6.3

Drupal Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Record
GHSA-mg8j-w93w-xjgc
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-209, CWE-497
Updated
2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-45440 5.3

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

Record
UBUNTU-CVE-2024-45440
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1776214337 No score

TuxCare security update for drupal/core (11 CVEs)

TuxCare rebuilt drupal/core to address 11 CVEs. Fixed in 9.5.11-p1+tuxcare.

Record
CLSA-2026-1776214337
Updated
2026-11-02
OSVCLSA-2026-1793202127 No score

TuxCare security update for drupal/core (1 CVE)

TuxCare rebuilt drupal/core to address 1 CVE. Fixed in 8.9.20-p10+tuxcare.

Record
CLSA-2026-1793202127
Updated
2026-11-02
OSVGHSA-6ccv-8fgf-cjpw No score

Drupal core Denial of Service vulnerability

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Record
GHSA-6ccv-8fgf-cjpw
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
drupal/core
Packagist
 8.0.0 up to 10.1.8
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2
10.2.2
drupal/drupal
Packagist
 11.0.0 up to 11.0.5
11.0.5
drupal/core-recommended
Packagist
 11.0.0 up to 11.0.5
11.0.5
drupal/core
Packagist
 11.0.0 up to 11.0.5
11.0.5
drupal/drupal
Packagist
 10.3.0 up to 10.3.6
10.3.6
drupal/core-recommended
Packagist
 10.3.0 up to 10.3.6
10.3.6
drupal/core
Packagist
 10.3.0 up to 10.3.6
10.3.6
drupal/drupal
Packagist
 8.0.0 up to 10.2.9
10.2.9
drupal/core-recommended
Packagist
 8.0.0 up to 10.2.9
10.2.9
Show 16 moreShow less
Affected packages
PackageAffectedFixed
drupal/core
Packagist
 8.0.0 up to 10.2.9
10.2.9
drupal/core
TuxCare:Packagist
From an advisory covering 10 CVEs
 9.5.11 up to 9.5.11-p1+tuxcare
9.5.11-p1+tuxcare
drupal/core
TuxCare:Packagist
 8.9.20 up to 8.9.20-p10+tuxcare, plus listed versions
8.9.20-p1+tuxcare8.9.20-p2+tuxcare8.9.20-p3+tuxcare8.9.20-p4+tuxcare8.9.20-p5+tuxcare
Show 4 moreShow less
8.9.20-p6+tuxcare8.9.20-p7+tuxcare8.9.20-p8+tuxcare8.9.20-p9+tuxcare
8.9.20-p10+tuxcare
drupal/core
Packagist
 8.0.0 up to 10.1.8, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.78.0.18.0.28.0.38.0.48.0.58.0.68.1.08.1.0-beta18.1.0-beta28.1.0-rc18.1.18.1.108.1.28.1.38.1.4
10.1.8
drupal/core
Packagist
 10.2.0 up to 10.2.2, plus listed versions
10.2.1
10.2.2
drupal/drupal
Packagist
 10.3.0 up to 10.3.6, plus listed versions
10.3.110.3.210.3.310.3.410.3.5
10.3.6
drupal/drupal
Packagist
 11.0.0 up to 11.0.5, plus listed versions
11.0.111.0.211.0.311.0.4
11.0.5
drupal/core-recommended
Packagist
 10.3.0 up to 10.3.6, plus listed versions
10.3.110.3.210.3.310.3.410.3.5
10.3.6
drupal/core-recommended
Packagist
 11.0.0 up to 11.0.5, plus listed versions
11.0.111.0.211.0.311.0.4
11.0.5
drupal/core
Packagist
 10.3.0 up to 10.3.6, plus listed versions
10.3.110.3.210.3.310.3.410.3.5
10.3.6
drupal/core
Packagist
 11.0.0 up to 11.0.5, plus listed versions
11.0.111.0.211.0.311.0.4
11.0.5
drupal/drupal
Packagist
 8.0.0 up to 10.2.9, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.210.2.310.2.410.2.510.2.610.2.710.2.88.0.18.0.2
10.2.9
drupal/core-recommended
Packagist
 8.0.0 up to 10.2.9, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.210.2.310.2.410.2.510.2.610.2.710.2.88.0.18.0.2
10.2.9
drupal/core
Packagist
 8.0.0 up to 10.2.9, plus listed versions
10.0.010.0.0-alpha110.0.0-alpha210.0.0-alpha310.0.0-alpha4
Show 45 moreShow less
10.0.0-alpha510.0.0-alpha610.0.0-alpha710.0.0-beta110.0.0-beta210.0.0-rc110.0.0-rc210.0.0-rc310.0.110.0.1010.0.1110.0.210.0.310.0.410.0.510.0.610.0.710.0.810.0.910.1.010.1.0-alpha110.1.0-beta110.1.0-rc110.1.110.1.210.1.310.1.410.1.510.1.610.1.710.1.810.2.010.2.0-alpha110.2.0-beta110.2.0-rc110.2.110.2.210.2.310.2.410.2.510.2.610.2.710.2.88.0.18.0.2
10.2.9
drupal7
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
7.23-17.24-17.24-27.26-17.26-1ubuntu0.17.26-1ubuntu0.1+esm17.26-1ubuntu0.1+esm27.26-1ubuntu0.1+esm3
 None known
drupal7
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
7.38-17.41-17.44-1ubuntu1~16.04.07.44-1ubuntu1~16.04.0+esm17.44-1ubuntu1~16.04.0+esm27.44-1ubuntu1~16.04.0+esm3
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubw0r1i0g1ht/CVE-2024-454402024-12-26
Exploit-DBDrupal 11.x-dev - Full Path Disclosure2025-04-19
PoC in GitHubzoomdbz/CVE-2024-454402026-02-10
NucleiDrupal 11.x-dev - Full Path Disclosure

History

History
RecordedChangedSources
affected, exploits, facts
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-45440 is a medium vulnerability (CVSS 5.3) in Drupal, published February 12, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.27%, the 95th percentile. Fixed in drupal/core 10.1.8.

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 1,166 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open