PT-2012-4193 · Drupal · Ubercart Product Keys

Kurt Seifried · Published 2012-06-27 · Updated 2017-08-29 · CVE-2012-2702

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubercart Product Keys module versions 6.x-1.x before 6.x-1.1 for Drupal

Description The issue allows remote attackers to read all unassigned product keys under certain conditions related to the uid. This occurs because the module does not properly check access for product keys.

Recommendations For Ubercart Product Keys module versions 6.x-1.x before 6.x-1.1, update to version 6.x-1.1 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-2702

Affected Products

Ubercart Product Keys

References · 8

• 🔥 http://drupalcode.org/project/uc_product_keys.git/commitdiff/19fa261 · Exploit
• http://drupal.org/node/1585532 · Vendor Advisory
• http://drupal.org/node/1580752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2702 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75720 · Note
• http://openwall.com/lists/oss-security/2012/06/14/3 · Note
• http://secunia.com/advisories/49169 · Note
• http://osvdb.org/82005 · Note