CVE-2013-7302

Ubercart module <6.2.13,7.3.6 - Session Fixation

Title source: llm

Description

Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID.

References (3)

[Patch] https://drupal.org/node/2158565

[Patch] https://drupal.org/node/2158567

[Patch, Vendor Advisory] https://drupal.org/node/2158651

Scores

EPSS 0.0041

EPSS Percentile 61.1%

Classification

CWE

CWE-287

Status draft

Affected Products (44)

ubercart/ubercart

... and 29 more

Timeline

Published Apr 29, 2014

Tracked Since Feb 18, 2026