CVE-2012-2702

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-27 · updated 2026-06-16
Weakness: CWE-264

Description

The Ubercart Product Keys module 6.x-1.x before 6.x-1.1 for Drupal does not properly check access for product keys, which allows remote attackers to read all unassigned product keys via certain conditions related to the uid.

Affected products

Tony Freixas Ubercart Product Keys: 6.x-1.0, 6.x-1.0-alpha1, 6.x-1.0-alpha2, 6.x-1.0-alpha3, 6.x-1.0-beta1, 6.x-1.0-rc1 (+1)

References

http://drupal.org/node/1580752
http://drupal.org/node/1585532
http://drupalcode.org/project/uc_product_keys.git/commitdiff/19fa261
http://osvdb.org/82005
http://secunia.com/advisories/49169
http://www.openwall.com/lists/oss-security/2012/06/14/3
https://exchange.xforce.ibmcloud.com/vulnerabilities/75720
http://drupal.org/node/1580752
http://drupal.org/node/1585532
http://drupalcode.org/project/uc_product_keys.git/commitdiff/19fa261
http://osvdb.org/82005
http://secunia.com/advisories/49169

Get alerted when CVE-2012-2702 or the next vulnerability affects your stack