Vulnerability advisory

CVE-2016-9449

Published Nov 25, 2016Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/drupal/drupal ↗
35c2f3ca5c935f3d8bde15932a712677c9bbd50f through ce174ee8bf12440b904c0cbdb9c5a01bdc1784c4	No fix listed
Also listed as affected (100) `7.0` `7.0-alpha1` `7.0-alpha2` `7.0-alpha3` `7.0-alpha4` `7.0-alpha5` `7.0-alpha6` `7.0-alpha7` `7.0-beta1` `7.0-beta2` `7.0-beta3` `7.1` `7.10` `7.11` `7.12` `7.13` `7.14` `7.15` `7.16` `7.17` `7.18` `7.19` `7.2` `7.20` `7.21` `7.22` `7.23` `7.24` `7.25` `7.26` `7.27` `7.28` `7.29` `7.3` `7.30` `7.31` `7.32` `7.33` `7.34` `7.35` `7.36` `7.37` `7.38` `7.4` `7.40` `7.41` `7.42` `7.43` `7.44` `7.50` `7.51` `8.0.0` `8.0.0-alpha14` `8.0.0-alpha15` `8.0.0-beta1` `8.0.0-beta10` `8.0.0-beta11` `8.0.0-beta12` `8.0.0-beta13` `8.0.0-beta14` `8.0.0-beta15` `8.0.0-beta16` `8.0.0-beta2` `8.0.0-beta3` `8.0.0-beta4` `8.0.0-beta6` `8.0.0-beta7` `8.0.0-beta9` `8.0.0-rc1` `8.0.0-rc2` `8.0.0-rc3` `8.0.0-rc4` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.1.0` `8.1.0-beta1` `8.1.0-beta2` `8.1.0-rc1` `8.1.1` `8.1.10` `8.1.2` `8.1.3` `8.1.4` `8.1.5` `8.1.6` `8.1.7` `8.1.8` `8.1.9` `8.2.0` `8.2.0-beta1` `8.2.0-beta2` `8.2.0-beta3` `8.2.0-rc1` `8.2.0-rc2` `8.2.1` `8.2.2`

Description

The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.

References

Advisorywww.debian.org/security/2016/dsa-3718 ↗
Advisorywww.securityfocus.com/bid/94367 ↗
Fixwww.drupal.org/SA-CORE-2016-005 ↗