CVE-2024-45440

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.

We have discovered 165,856 live websites that are affected by CVE-2024-45440.

Run a Free Instant Scan



Affected Software

Product  Drupal
Category Content Management System
Vulnerable Domains165,856 live websites (79% of Drupal install base)
Vulnerable Versions
  • from 0 through 10.2
Vulnerable Versions Count223 versions ( 67% of all versions)



Details

  • Published - Aug 29, 2024
  • Updated - Apr 21, 2025

Website Distribution by Country

Number of websites using CVE-2024-45440
United States51,105 websites


Germany15,646 websites
France12,382 websites
Russia11,534 websites
Belgium6,550 websites
GB6,008 websites
Italy5,323 websites
Netherlands4,926 websites
Canada4,185 websites
Spain3,935 websites

Website Distribution by TLD

Number of websites using CVE-2024-45440
.com42,956 websites
.org15,191 websites
.de9,747 websites
.ru9,276 websites
.edu7,275 websites
.fr6,563 websites
.be6,192 websites
.nl4,183 websites
.it4,002 websites
.net3,671 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2024-45440

Top websites that are affected by CVE-2024-45440. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
***.**.uk GB***
***.gov United States***
***.org United States*,***
*******.gov United States*,***
***.gov United States*,***
******.com United States*,***
***.org United States*,***
***.*******.edu United States*,***
****.gov United States*,***
********.gov United States*,***
See full domain list

FAQ

A total of 165,856 websites have been identified as vulnerable to CVE-2024-45440, based on global website indexing conducted by WebTechSurvey.
The Drupal is affected by the CVE-2024-45440 vulnerability.
Drupal versions up to 10.2 are vulnerable to CVE-2024-45440.
CVE-2024-45440 is resolved in version 10.2 of Drupal.