PT-2012-3933 · Drupal · Ubercart

Greg Knaddison · Published 2012-08-14 · Updated 2012-08-15 · CVE-2012-2299

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubercart module versions 6.x-2.x through 6.x-2.7 Ubercart module versions 7.x-3.x through 7.x-3.0

Description The issue allows local users to obtain sensitive information by reading from the database because passwords for new customers are stored in plaintext during checkout.

Recommendations For Ubercart module versions 6.x-2.x through 6.x-2.7, update to version 6.x-2.8 or later. For Ubercart module versions 7.x-3.x through 7.x-3.0, update to version 7.x-3.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2012-2299

Affected Products

Ubercart

References · 11

• 🔥 http://drupalcode.org/project/ubercart.git/commitdiff/035d2cb · Exploit
• 🔥 http://drupalcode.org/project/ubercart.git/commitdiff/8c61e84 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2299 · Security Note
• http://drupal.org/node/1547506 · Patch
• http://drupal.org/node/1547674 · Vendor Advisory
• http://drupal.org/node/1547508 · Patch
• http://secunia.com/advisories/48935 · Vendor Advisory
• http://openwall.com/lists/oss-security/2012/05/03/2 · Note
• http://openwall.com/lists/oss-security/2012/05/03/1 · Note
• http://securityfocus.com/bid/53251 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2299 · Note