CVE-2012-2731
Summary
| CVE | CVE-2012-2731 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-06-27 00:55:05 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:H/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Drupal | Drupal | - | All | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | All | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | alpha6 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | alpha7 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | alpha8 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta1 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta10 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta11 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta2 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta3 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta4 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta5 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta6 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta7 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta8 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | beta9 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | rc1 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | rc2 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | rc3 | All | All |
| Application | Richardo Ante | Ubercart Ajax Cart | 6.x-2.0 | rc4 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Drupal Ubercart AJAX Cart Module Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| oss-security - Re: CVE Request for Drupal contributed modules | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| uc_ajax_cart 6.x-2.1 | drupal.org | af854a3a-2127-422b-91ae-364da2661108 | drupal.org | Patch |
| SA-CONTRIB-2012-102 - Ubercart AJAX Cart - Potential Disclosure of user Session ID | drupal.org | af854a3a-2127-422b-91ae-364da2661108 | drupal.org | Patch, Vendor Advisory |
| Log in | Drupal.org | af854a3a-2127-422b-91ae-364da2661108 | drupalcode.org | Exploit |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.