Read the docs
TI-2012-02363 Aliases CVE-2012-2731GHSA-cwq8-5gf7-6jfp

The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the…

Priority LOW 17CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
Partial · None · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.

Why it matters now

EPSS 0.02144 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:*:*:*:*:*:*:*6.x-2.0VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha6:*:*:*:*:*:*6.x-2.0 alpha6VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha7:*:*:*:*:*:*6.x-2.0 alpha7VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha8:*:*:*:*:*:*6.x-2.0 alpha8VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta1:*:*:*:*:*:*6.x-2.0 beta1VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta10:*:*:*:*:*:*6.x-2.0 beta10VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta11:*:*:*:*:*:*6.x-2.0 beta11VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta2:*:*:*:*:*:*6.x-2.0 beta2VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta3:*:*:*:*:*:*6.x-2.0 beta3VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta4:*:*:*:*:*:*6.x-2.0 beta4VulnerableRichardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:*:*:*:*:*:*:* Versions 6.x-2.0 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha6:*:*:*:*:*:* Versions 6.x-2.0 alpha6 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha7:*:*:*:*:*:* Versions 6.x-2.0 alpha7 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:alpha8:*:*:*:*:*:* Versions 6.x-2.0 alpha8 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta1:*:*:*:*:*:* Versions 6.x-2.0 beta1 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta10:*:*:*:*:*:* Versions 6.x-2.0 beta10 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta11:*:*:*:*:*:* Versions 6.x-2.0 beta11 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta2:*:*:*:*:*:* Versions 6.x-2.0 beta2 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta3:*:*:*:*:*:* Versions 6.x-2.0 beta3 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta4:*:*:*:*:*:* Versions 6.x-2.0 beta4 Vulnerable ·Richardo Ante
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta5:*:*:*:*:*:*6.x-2.0 beta5VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta6:*:*:*:*:*:*6.x-2.0 beta6VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta7:*:*:*:*:*:*6.x-2.0 beta7VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta8:*:*:*:*:*:*6.x-2.0 beta8VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta9:*:*:*:*:*:*6.x-2.0 beta9VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc1:*:*:*:*:*:*6.x-2.0 rc1VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc2:*:*:*:*:*:*6.x-2.0 rc2VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc3:*:*:*:*:*:*6.x-2.0 rc3VulnerableRichardo Ante
cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc4:*:*:*:*:*:*6.x-2.0 rc4VulnerableRichardo Ante
cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:*not specified by NVDRunning onDrupal
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta5:*:*:*:*:*:* Versions 6.x-2.0 beta5 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta6:*:*:*:*:*:* Versions 6.x-2.0 beta6 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta7:*:*:*:*:*:* Versions 6.x-2.0 beta7 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta8:*:*:*:*:*:* Versions 6.x-2.0 beta8 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:beta9:*:*:*:*:*:* Versions 6.x-2.0 beta9 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc1:*:*:*:*:*:* Versions 6.x-2.0 rc1 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc2:*:*:*:*:*:* Versions 6.x-2.0 rc2 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc3:*:*:*:*:*:* Versions 6.x-2.0 rc3 Vulnerable ·Richardo Ante
  • cpe:2.3:a:richardo_ante:ubercart_ajax_cart:6.x-2.0:rc4:*:*:*:*:*:* Versions 6.x-2.0 rc4 Vulnerable ·Richardo Ante
  • cpe:2.3:a:drupal:drupal:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Drupal

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-2731
  2. 2026-10-03 Alias added: GHSA-cwq8-5gf7-6jfp

References

Exploit 1

Patch 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences