Unscored severity · published Apr 29, 2014
CVE-2013-7302
Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UB
Ubercart · Ubercart
6.x-2.0; 6.x-2.0; 6.x-2.0; 6.x-2.0; 6.x-2.0; 6.x-2.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7302
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7302
Patch
https://drupal.org/node/2158565
Patch
https://drupal.org/node/2158567
Patch
https://drupal.org/node/2158651
More from Ubercart
–
CVE-2014-9026
The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders"…
–
CVE-2012-2301
The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via…
–
CVE-2013-0322
Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the…
–
CVE-2012-5804
The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…
–
CVE-2012-5803
The Authorize.Net module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…