The vulnerability of the /core/authorize.php file in the Drupal CMS system allows a hacker to disclose protected information.

🗓️ 03 Oct 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 10 Views

The Drupal authorize.php vulnerability may disclose protected data via hash_salt in settings.php.

Reporter	Title	Published	Views	Family All 24
GithubExploit	Exploit for Generation of Error Message Containing Sensitive Information in Drupal	10 Feb 202616:18	–	githubexploit
Circl	CVE-2024-45440	29 Aug 202413:42	–	circl
CNNVD	Drupal 安全漏洞	29 Aug 202400:00	–	cnnvd
CVE	CVE-2024-45440	29 Aug 202400:00	–	cve
Cvelist	CVE-2024-45440	29 Aug 202400:00	–	cvelist
Exploit DB	Drupal 11.x-dev - Full Path Disclosure	19 Apr 202500:00	–	exploitdb
Github Security Blog	Drupal Full Path Disclosure	29 Aug 202412:31	–	github
Nuclei	Drupal 11.x-dev - Full Path Disclosure	1 Jul 202603:36	–	nuclei
NVD	CVE-2024-45440	29 Aug 202411:15	–	nvd
OpenVAS	Drupal Information Disclosure Vulnerability (GHSA-mg8j-w93w-xjgc) - Linux - Version Check	3 Feb 202500:00	–	openvas

Source	Link
drupal	www.drupal.org/project/drupal/issues/3457781
git	www.git.drupalcode.org/project/drupal/-/commit/3ebfcc8919d93272e2d2166de76aca1afb202bc8
git	www.git.drupalcode.org/project/drupal/-/commit/827ddbfe7925b54d797880d8d3c2b57e65c66b81
git	www.git.drupalcode.org/project/drupal/-/commit/97118bca05f60133a4110af66d497dd508138a79
git	www.git.drupalcode.org/project/drupal/-/commit/48b0aea1d573d9e01752f9909ec8cd3a1b7e3378
senscybersecurity	www.senscybersecurity.nl/CVE-2024-45440-Explained/
owasp	www.owasp.org/www-community/attacks/Full_Path_Disclosure
vuldb	www.vuldb.com/
feedly	www.feedly.com/cve/CVE-2024-45440
github	www.github.com/advisories/GHSA-mg8j-w93w-xjgc

05 Mar 2026 00:00Current

5.4Medium risk

Vulners AI Score5.4

CVSS 25

CVSS 35.3

EPSS0.09269

drupal authorize file data disclosure hash salt settings file protected information