core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the     value of hash_salt is file_get_contents of a file that does not exist. (CVE-2024-45440)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the
    value of hash_salt is file_get_contents of a file that does not exist. (CVE-2024-45440)

Drupal versions prior to 10.2.9, 10.3.x < 10.3.6 and 11.0.x < 11.0.5 are affected by Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

ID	Name	Product	Family	Type	Severity
248512	Linux Distros Unpatched Vulnerability : CVE-2024-45440	Nessus	Misc.	Local	medium
421329	SCA: security update for drupal/core, drupal/core-recommended, drupal/drupal (GHSA-mg8j-w93w-xjgc)	Tenable Cloud Security	SCA Checks	Local	medium
421329	SCA: security update for drupal/core, drupal/core-recommended, drupal/drupal (GHSA-mg8j-w93w-xjgc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
114584	Drupal Full Path Disclosures	Web App Scanning	Component Vulnerability	Check Based	medium

Detections

Analytics

CVE-2024-45440

medium

Tenable Plugins

medium

medium

medium

medium