CVE-2013-7302

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-04-29 · updated 2026-06-17
Weakness: CWE-287

Description

Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID.

Affected products

Ubercart: 6.x-2.0, 6.x-2.0-beta1, 6.x-2.0-beta2, 6.x-2.0-beta3, 6.x-2.0-beta4, 6.x-2.0-beta5 (+38)

References

https://drupal.org/node/2158565
https://drupal.org/node/2158567
https://drupal.org/node/2158651
https://drupal.org/node/2158565
https://drupal.org/node/2158567
https://drupal.org/node/2158651

Get alerted when CVE-2013-7302 or the next vulnerability affects your stack