Vulnerability CVE-2012-2702
Published: 2012-06-26   Modified: 2012-06-27

Description:
The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, which allows remote attackers to read all unassigned product keys via certain conditions related to the uid.

See advisories in our WLB2 database:
Topic
Author
Date
High
Drupal Ubercart Product Keys 6.x Access Bypass
Daniel Glucksman
17.05.2012

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Tony freixas -> Ubercart product keys 

 References:
http://drupalcode.org/project/uc_product_keys.git/commitdiff/19fa261
http://drupal.org/node/1585532
http://drupal.org/node/1580752
http://www.openwall.com/lists/oss-security/2012/06/14/3
Copyright 2024, cxsecurity.com

 

Back to Top