Drupal Ubercart Module Session Fixation Vulnerability
BID:64436
Info
Drupal Ubercart Module Session Fixation Vulnerability
| Bugtraq ID: | 64436 |
| Class: | Unknown |
| CVE: |
CVE-2013-7302 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 18 2013 12:00AM |
| Updated: | Jan 22 2014 01:02AM |
| Credit: | mettasoul |
| Vulnerable: |
Drupal Ubercart 7.x-3.0 Drupal Ubercart 6.x-2.0 |
| Not Vulnerable: | |
Discussion
Drupal Ubercart Module Session Fixation Vulnerability
Ubercart is prone to a session-fixation vulnerability due to an insufficient protection of session ID.
An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application.
Ubercart 6.x-2.x versions prior to 6.x-2.13 and 7.x-3.x versions prior to 7.x-3.6 are vulnerable.
Ubercart is prone to a session-fixation vulnerability due to an insufficient protection of session ID.
An attacker can exploit this issue to hijack an arbitrary session and gain unauthorized access to the affected application.
Ubercart 6.x-2.x versions prior to 6.x-2.13 and 7.x-3.x versions prior to 7.x-3.6 are vulnerable.
Exploit / POC
Drupal Ubercart Module Session Fixation Vulnerability
To exploit this issue an attacker entices an unsuspecting user into following a malicious URI.
To exploit this issue an attacker entices an unsuspecting user into following a malicious URI.
Solution / Fix
Drupal Ubercart Module Session Fixation Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.