PT-2012-3933 · Drupal · Ubercart

Greg Knaddison · Publicado 2012-08-14 · Atualizado 2012-08-15 · CVE-2012-2299

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubercart module versions 6.x-2.x through 6.x-2.7 Ubercart module versions 7.x-3.x through 7.x-3.0

Description The issue allows local users to obtain sensitive information by reading from the database because passwords for new customers are stored in plaintext during checkout.

Recommendations For Ubercart module versions 6.x-2.x through 6.x-2.7, update to version 6.x-2.8 or later. For Ubercart module versions 7.x-3.x through 7.x-3.0, update to version 7.x-3.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2012-2299

Produtos afetados

Ubercart

Referências · 11

• 🔥 http://drupalcode.org/project/ubercart.git/commitdiff/035d2cb · Exploit
• 🔥 http://drupalcode.org/project/ubercart.git/commitdiff/8c61e84 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2299 · Nota de Segurança
• http://openwall.com/lists/oss-security/2012/05/03/2 · Nota
• http://drupal.org/node/1547506 · Correção
• http://openwall.com/lists/oss-security/2012/05/03/1 · Nota
• http://securityfocus.com/bid/53251 · Nota
• http://drupal.org/node/1547674 · Aviso do Fabricante
• http://drupal.org/node/1547508 · Correção
• http://secunia.com/advisories/48935 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2299 · Nota