CVEvulnerability
CVE-2012-2731
2.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2012-06-27
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
Affected configurations
• richardo ante ubercart ajax cart 6.x-2.0
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://drupal.org/node/1619586 Patch
- http://drupal.org/node/1633048 Patch, Vendor Advisory
- http://drupalcode.org/project/uc_ajax_cart.git/commitdiff/b59cdd5 Exploit
- http://www.openwall.com/lists/oss-security/2012/06/14/3 www.openwall.com
- http://www.securityfocus.com/bid/53999 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76332 exchange.xforce.ibmcloud.com
- http://drupal.org/node/1619586 Patch
- http://drupal.org/node/1633048 Patch, Vendor Advisory
- http://drupalcode.org/project/uc_ajax_cart.git/commitdiff/b59cdd5 Exploit
- http://www.openwall.com/lists/oss-security/2012/06/14/3 www.openwall.com
- http://www.securityfocus.com/bid/53999 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76332 exchange.xforce.ibmcloud.com