| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/core | ≥ 10.3.0, < 10.3.6≥ 11.0.0, < 11.0.5≥ 8.0.0, < 10.2.9 | 10.3.611.0.510.2.9 |
| drupal/core-recommended | ≥ 10.3.0, < 10.3.6≥ 11.0.0, < 11.0.5≥ 8.0.0, < 10.2.9 | 10.3.611.0.510.2.9 |
| drupal/drupal | ≥ 10.3.0, < 10.3.6≥ 11.0.0, < 11.0.5≥ 8.0.0, < 10.2.9 | 10.3.611.0.510.2.9 |
| drupal | = 2023-05-09 |
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free