{"id":"CVE-2016-9449","aliases":["DLA-715-1","DSA-3718-1","EUVD-2022-4701","GHSA-p745-347h-hjfw","MGASA-2016-0413","UBUNTU-CVE-2016-9449"],"status":"published","title":"Drupal sensitive information disclosure","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01903,"percentile":0.7985,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-11-17T00:00:00Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"Packagist","package":"drupal/core","fixed_in":["7.52","8.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"drupal/drupal","fixed_in":["8.2.3","7.52"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0"},{"fixed":"7.52"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.2.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.2.3"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0"},{"fixed":"7.52"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u15"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u10","7.14-2+deb7u10~bpo60+1","7.14-2+deb7u11","7.14-2+deb7u11~bpo60+1","7.14-2+deb7u12","7.14-2+deb7u13","7.14-2+deb7u14","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7","7.14-2+deb7u7~bpo60+1","7.14-2+deb7u8","7.14-2+deb7u9","7.14-2+deb7u9~bpo60+1"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.32-1+deb8u8"}]}],"versions":["7.32-1+deb8u3","7.32-1+deb8u4","7.32-1+deb8u4~bpo70+1","7.32-1+deb8u5","7.32-1+deb8u5~bpo70+1","7.32-1+deb8u6","7.32-1+deb8u7"],"bundled":2},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0"},{"fixed":"7.52"}]}]},{"source":"osv","ecosystem":"Packagist","package":"drupal/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.2.3"}]}],"versions":["8.0.0","8.0.0-beta10","8.0.0-beta11","8.0.0-beta12","8.0.0-beta13","8.0.0-beta14","8.0.0-beta15","8.0.0-beta16","8.0.0-beta6","8.0.0-beta7","8.0.0-beta8","8.0.0-beta9","8.0.0-rc1","8.0.0-rc2","8.0.0-rc3","8.0.0-rc4","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0"},{"fixed":"8.2.3"}]}],"versions":["8.0.0","8.0.0-alpha14","8.0.0-alpha15","8.0.0-beta1","8.0.0-beta10","8.0.0-beta11","8.0.0-beta12","8.0.0-beta13","8.0.0-beta14","8.0.0-beta15","8.0.0-beta16","8.0.0-beta2","8.0.0-beta3","8.0.0-beta4","8.0.0-beta5","8.0.0-beta6","8.0.0-beta7","8.0.0-beta9","8.0.0-rc1","8.0.0-rc2","8.0.0-rc3","8.0.0-rc4","8.0.1","8.0.2","8.0.3","8.0.4","8.0.5","8.0.6","8.1.0","8.1.0-beta1","8.1.0-beta2","8.1.0-rc1","8.1.1","8.1.10","8.1.2","8.1.3","8.1.4","8.1.5","8.1.6","8.1.7","8.1.8","8.1.9","8.2.0","8.2.0-beta1","8.2.0-beta2","8.2.0-beta3","8.2.0-rc1","8.2.0-rc2","8.2.1","8.2.2"]},{"source":"osv","ecosystem":"Packagist","package":"drupal/drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0"},{"fixed":"7.52"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.38-1","7.41-1","7.44-1ubuntu1~16.04.0","7.44-1ubuntu1~16.04.0+esm1","7.44-1ubuntu1~16.04.0+esm2","7.44-1ubuntu1~16.04.0+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.debian.org/security/2016/dsa-3718","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/94367","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.drupal.org/SA-CORE-2016-005","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9449","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/core/CVE-2016-9449.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2016-9449.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-p745-347h-hjfw"},{"url":"https://github.com/drupal/core","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2016-0413.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19812","tags":["report"]},{"url":"https://www.drupal.org/drupal-7.45","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.45-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.46","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.46-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.47","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.47-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.48","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.48-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.49","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.49-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.50","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.50-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.51","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.51-release-notes","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.52","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.52-release-notes","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/11/18/16","tags":["web"]},{"url":"https://lwn.net/Vulnerabilities/707038/","tags":["web"]},{"url":"https://lwn.net/Vulnerabilities/707041/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-9449","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/11/18/8","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9449","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-9449","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","status":"published","published":"2016-11-25T18:00:00Z","modified":"2024-08-06T02:50:38.506Z","updated_at":"2026-11-02T14:33:31.764001Z"}],"euvd":[{"id":"EUVD-2022-4701","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","status":"published","published":"2016-11-25T18:00:00Z","modified":"2024-08-06T02:50:38Z","updated_at":"2026-11-03T02:22:26.803486Z"}],"ghsa":[{"id":"GHSA-p745-347h-hjfw","title":"Drupal sensitive information disclosure","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","status":"published","published":"2022-05-17T03:05:27Z","modified":"2024-04-23T22:17:27Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:44.867253Z"}],"nvd":[{"id":"CVE-2016-9449","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","status":"published","published":"2016-11-25T18:59:00.387Z","modified":"2026-06-17T00:56:05.517Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:32.79141Z"}],"osv":[{"id":"CVE-2016-9449","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","status":"published","published":"2016-11-25T18:59:00.387Z","modified":"2026-10-24T10:30:54.344209385Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"GHSA-p745-347h-hjfw","title":"Drupal sensitive information disclosure","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","status":"published","published":"2022-05-17T03:05:27Z","modified":"2024-04-23T22:41:48.673391Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:52.891208Z"},{"id":"UBUNTU-CVE-2016-9449","description":"The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.","status":"published","published":"2016-11-25T18:59:00Z","modified":"2025-09-08T16:43:56Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:13.356796Z"},{"id":"DLA-715-1","title":"drupal7 - security update","status":"published","published":"2016-11-21T00:00:00Z","modified":"2026-03-09T02:09:55.633349Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3718-1","title":"drupal7 - security update","status":"published","published":"2016-11-17T00:00:00Z","modified":"2026-03-09T01:21:57.585986Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0413","title":"Updated drupal packages fix security vulnerability","description":"Inconsistent name for term access query; information on taxonomy terms\nmight have been disclosed to unprivileged users (CVE-2016-9449).\n\nConfirmation forms allow external URLs to be injected (CVE-2016-9451).\n","status":"published","published":"2016-12-07T11:48:35Z","modified":"2026-04-16T06:22:46.302760566Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}