Information disclosure in Drupal
CVE-2012-2731
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
Vulnerability class: Information Disclosure
EPSS: 0.022 (80.4th percentile) — read the EPSS interpretation.
Affected products
- Drupal
- Richardo_ante Ubercart_ajax_cart — versions 6.x-2.0
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Exploit)
- secalert@redhat.com (vdb-entry, x_refsource_XF)
- secalert@redhat.com (vdb-entry, x_refsource_BID)
- secalert@redhat.com (Patch, x_refsource_MISC, Vendor Advisory)
- secalert@redhat.com (mailing-list, x_refsource_MLIST)
- secalert@redhat.com (x_refsource_CONFIRM, Patch)