CVE-2012-2731 describes an information disclosure vulnerability in the Ubercart AJAX Cart module for Drupal versions 6.x-2.x before 6.x-2.1. The module inadvertently stores the PHP session ID within the JavaScript settings array during page loads. This flaw could allow remote attackers to obtain sensitive session information through network sniffing or by accessing cached HTML content. The vulnerability has a low severity CVSS score of 2.6, indicating a network-based attack with high access complexity and potential for partial confidentiality impact. There is no impact on integrity or availability. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The CVE has received minimal community discussion and media coverage, suggesting low public awareness and interest.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
6.x-2.0CPE matchmatch criteria | cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:*:*:*:*:*:*:* | ||
6.x-2.0CPE matchmatch criteria | cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha6:*:*:*:*:*:* | ||
6.x-2.0CPE matchmatch criteria | cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha7:*:*:*:*:*:* | ||
6.x-2.0CPE matchmatch criteria | cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha8:*:*:*:*:*:* | ||
6.x-2.0CPE matchmatch criteria | cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta1:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:H/Au:N/C:P/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.