CVE-2016-9449 Drupal sensitive information disclosure
MediumCVSS 4.3
EPSS 1.9%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/core(Packagist) | >= 7.0, < 7.52 | 7.52 |
| drupal/core(Packagist) | >= 8.0, < 8.2.3 | 8.2.3 |
| drupal/core(Packagist) | = 8.0.0 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta10 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta11 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta12 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta13 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta14 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta15 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta16 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta6 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta7 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta8 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-beta9 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc2 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc3 | No fix listed |
| drupal/core(Packagist) | = 8.0.0-rc4 | No fix listed |
| drupal/core(Packagist) | = 8.0.1 | No fix listed |
| drupal/core(Packagist) | = 8.0.2 | No fix listed |
| drupal/core(Packagist) | = 8.0.3 | No fix listed |
| drupal/core(Packagist) | = 8.0.4 | No fix listed |
| drupal/core(Packagist) | = 8.0.5 | No fix listed |
| drupal/core(Packagist) | = 8.0.6 | No fix listed |
| drupal/core(Packagist) | = 8.1.0 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| drupal/core(Packagist) | = 8.1.0-beta1 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-beta2 | No fix listed |
| drupal/core(Packagist) | = 8.1.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.1.1 | No fix listed |
| drupal/core(Packagist) | = 8.1.10 | No fix listed |
| drupal/core(Packagist) | = 8.1.2 | No fix listed |
| drupal/core(Packagist) | = 8.1.3 | No fix listed |
| drupal/core(Packagist) | = 8.1.4 | No fix listed |
| drupal/core(Packagist) | = 8.1.5 | No fix listed |
| drupal/core(Packagist) | = 8.1.6 | No fix listed |
| drupal/core(Packagist) | = 8.1.7 | No fix listed |
| drupal/core(Packagist) | = 8.1.8 | No fix listed |
| drupal/core(Packagist) | = 8.1.9 | No fix listed |
| drupal/core(Packagist) | = 8.2.0 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-beta1 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-beta2 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-beta3 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-rc1 | No fix listed |
| drupal/core(Packagist) | = 8.2.0-rc2 | No fix listed |
| drupal/core(Packagist) | = 8.2.1 | No fix listed |
| drupal/core(Packagist) | = 8.2.2 | No fix listed |
| drupal/drupal(Packagist) | >= 8.0, < 8.2.3 | 8.2.3 |
| drupal/drupal(Packagist) | = 8.0.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-alpha14 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-alpha15 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta10 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta11 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta12 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta13 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta14 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta15 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta16 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta4 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta5 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta6 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta7 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-beta9 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.0-rc4 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.3 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.4 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.5 | No fix listed |
| drupal/drupal(Packagist) | = 8.0.6 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0-beta2 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.10 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.2 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.3 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.4 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.5 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.6 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.7 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.8 | No fix listed |
| drupal/drupal(Packagist) | = 8.1.9 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-beta1 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-beta2 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-beta3 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-rc1 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.0-rc2 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.1 | No fix listed |
| drupal/drupal(Packagist) | = 8.2.2 | No fix listed |
| drupal/drupal(Packagist) | >= 7.0, < 7.52 | 7.52 |
| drupal/drupal | = 8.0.0 | No fix listed |
| drupal/drupal | = 8.0.0-alpha10 | No fix listed |
| drupal/drupal | = 8.0.0-alpha11 | No fix listed |
| drupal/drupal | = 8.0.0-alpha12 | No fix listed |
| drupal/drupal | = 8.0.0-alpha13 | No fix listed |
| drupal/drupal | = 8.0.0-alpha14 | No fix listed |
| drupal/drupal | = 8.0.0-alpha15 | No fix listed |
| drupal/drupal | = 8.0.0-alpha2 | No fix listed |
| drupal/drupal | = 8.0.0-alpha3 | No fix listed |
| drupal/drupal | = 8.0.0-alpha4 | No fix listed |
| drupal/drupal | = 8.0.0-alpha5 | No fix listed |
| drupal/drupal | = 8.0.0-alpha6 | No fix listed |
| drupal/drupal | = 8.0.0-alpha7 | No fix listed |
| drupal/drupal | = 8.0.0-alpha8 | No fix listed |
| drupal/drupal | = 8.0.0-alpha9 | No fix listed |
| drupal/drupal | = 8.0.0-beta1 | No fix listed |
| drupal/drupal | = 8.0.0-beta10 | No fix listed |
| drupal/drupal | = 8.0.0-beta11 | No fix listed |
| drupal/drupal | = 8.0.0-beta12 | No fix listed |
| drupal/drupal | = 8.0.0-beta13 | No fix listed |
| drupal/drupal | = 8.0.0-beta14 | No fix listed |
| drupal/drupal | = 8.0.0-beta15 | No fix listed |
| drupal/drupal | = 8.0.0-beta16 | No fix listed |
| drupal/drupal | = 8.0.0-beta2 | No fix listed |
| drupal/drupal | = 8.0.0-beta3 | No fix listed |
| drupal/drupal | = 8.0.0-beta4 | No fix listed |
| drupal/drupal | = 8.0.0-beta6 | No fix listed |
| drupal/drupal | = 8.0.0-beta7 | No fix listed |
| drupal/drupal | = 8.0.0-beta9 | No fix listed |
| drupal/drupal | = 8.0.0-rc1 | No fix listed |
| drupal/drupal | = 8.0.0-rc2 | No fix listed |
| drupal/drupal | = 8.0.0-rc3 | No fix listed |
| drupal/drupal | = 8.0.0-rc4 | No fix listed |
| drupal/drupal | = 8.0.1 | No fix listed |
| drupal/drupal | = 8.0.2 | No fix listed |
| drupal/drupal | = 8.0.3 | No fix listed |
| drupal/drupal | = 8.0.4 | No fix listed |
| drupal/drupal | = 8.0.5 | No fix listed |
| drupal/drupal | = 8.0.6 | No fix listed |
| drupal/drupal | = 8.1.0 | No fix listed |
| drupal/drupal | = 8.1.0-beta1 | No fix listed |
| drupal/drupal | = 8.1.0-beta2 | No fix listed |
| drupal/drupal | = 8.1.0-rc1 | No fix listed |
| drupal/drupal | = 8.1.1 | No fix listed |
| drupal/drupal | = 8.1.2 | No fix listed |
| drupal/drupal | = 8.1.3 | No fix listed |
| drupal/drupal | = 8.1.4 | No fix listed |
| drupal/drupal | = 8.1.5 | No fix listed |
| drupal/drupal | = 8.1.6 | No fix listed |
| drupal/drupal | = 8.1.7 | No fix listed |
| drupal/drupal | = 8.1.8 | No fix listed |
| drupal/drupal | = 8.1.9 | No fix listed |
| drupal/drupal | = 8.1.10 | No fix listed |
| drupal/drupal | = 8.2.0 | No fix listed |
| drupal/drupal | = 8.2.0-beta1 | No fix listed |
| drupal/drupal | = 8.2.0-beta2 | No fix listed |
| drupal/drupal | = 8.2.0-beta3 | No fix listed |
| drupal/drupal | = 8.2.0-rc1 | No fix listed |
| drupal/drupal | = 8.2.0-rc2 | No fix listed |
| drupal/drupal | = 8.2.1 | No fix listed |
| drupal/drupal | = 8.2.2 | No fix listed |
| drupal/drupal | = 7.0 | No fix listed |
| drupal/drupal | = 7.0-alpha1 | No fix listed |
| drupal/drupal | = 7.0-alpha2 | No fix listed |
| drupal/drupal | = 7.0-alpha3 | No fix listed |
| drupal/drupal | = 7.0-alpha4 | No fix listed |
| drupal/drupal | = 7.0-alpha5 | No fix listed |
| drupal/drupal | = 7.0-alpha6 | No fix listed |
| drupal/drupal | = 7.0-alpha7 | No fix listed |
| drupal/drupal | = 7.0-beta1 | No fix listed |
| drupal/drupal | = 7.0-beta2 | No fix listed |
| drupal/drupal | = 7.0-beta3 | No fix listed |
| drupal/drupal | = 7.0-dev | No fix listed |
| drupal/drupal | = 7.0-rc1 | No fix listed |
| drupal/drupal | = 7.0-rc2 | No fix listed |
| drupal/drupal | = 7.0-rc3 | No fix listed |
| drupal/drupal | = 7.0-rc4 | No fix listed |
| drupal/drupal | = 7.1 | No fix listed |
| drupal/drupal | = 7.2 | No fix listed |
| drupal/drupal | = 7.3 | No fix listed |
| drupal/drupal | = 7.4 | No fix listed |
| drupal/drupal | = 7.10 | No fix listed |
| drupal/drupal | = 7.11 | No fix listed |
| drupal/drupal | = 7.12 | No fix listed |
| drupal/drupal | = 7.13 | No fix listed |
| drupal/drupal | = 7.14 | No fix listed |
| drupal/drupal | = 7.15 | No fix listed |
| drupal/drupal | = 7.16 | No fix listed |
| drupal/drupal | = 7.17 | No fix listed |
| drupal/drupal | = 7.18 | No fix listed |
| drupal/drupal | = 7.19 | No fix listed |
| drupal/drupal | = 7.20 | No fix listed |
| drupal/drupal | = 7.21 | No fix listed |
| drupal/drupal | = 7.22 | No fix listed |
| drupal/drupal | = 7.23 | No fix listed |
| drupal/drupal | = 7.24 | No fix listed |
| drupal/drupal | = 7.25 | No fix listed |
| drupal/drupal | = 7.26 | No fix listed |
| drupal/drupal | = 7.27 | No fix listed |
| drupal/drupal | = 7.28 | No fix listed |
| drupal/drupal | = 7.29 | No fix listed |
| drupal/drupal | = 7.30 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com exploit
- github.com product
- www.drupal.org patch vendor-advisory
- DSA-3718 vendor-advisory
- 94367 third-party-advisory vdb-entry
- github.com