Auth bypass in Drupal

CVE-2013-7302

Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID.

Vulnerability class: Broken Authentication

EPSS: 0.013 (68.5th percentile) — read the EPSS interpretation.

Affected products

  • Drupal
  • Ubercart — versions 6.x-2.0, 6.x-2.1, 6.x-2.2
  • N/a — versions n/a

Weakness classification (CWE)

References