CVE-2012-2731

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-27 · updated 2026-06-16
Weakness: CWE-200

Description

The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.

Affected products

Richardo Ante Ubercart Ajax Cart: 6.x-2.0, 6.x-2.0-alpha6, 6.x-2.0-alpha7, 6.x-2.0-alpha8, 6.x-2.0-beta1, 6.x-2.0-beta10 (+13)

References

http://drupal.org/node/1619586
http://drupal.org/node/1633048
http://drupalcode.org/project/uc_ajax_cart.git/commitdiff/b59cdd5
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.securityfocus.com/bid/53999
https://exchange.xforce.ibmcloud.com/vulnerabilities/76332
http://drupal.org/node/1619586
http://drupal.org/node/1633048
http://drupalcode.org/project/uc_ajax_cart.git/commitdiff/b59cdd5
http://www.openwall.com/lists/oss-security/2012/06/14/3
http://www.securityfocus.com/bid/53999
https://exchange.xforce.ibmcloud.com/vulnerabilities/76332

Get alerted when CVE-2012-2731 or the next vulnerability affects your stack