TI-2021-12838 Aliases CVE-2021-33394 GHSA-v9x5-5pq6-7848

Cubecart 6.4.2 allows Session Fixation.

LOW 26CWE-384Published 2021-05-27 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-384.

Summary

Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.

Why it matters now

EPSS 0.00696 53rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:cubecart:cubecart:6.4.2:::::::*	6.4.2	Vulnerable	cubecart

cpe:2.3:a:cubecart:cubecart:6.4.2:*:*:*:*:*:*:* Versions 6.4.2 Vulnerable ·cubecart

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-33394
2026-10-03 Alias added: GHSA-v9x5-5pq6-7848

References

Exploit 1

https://github.com/xoffense/POC/blob/main/Session%20Fixation%20in%20Cubecart%206.4.2.md

Patch 1

https://github.com/cubecart/v6/commit/aac7b3a13a43e302d91f94a120417b2fda737d0f

TI-2024-23117 Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to… CVSS 3.1CRITICAL 9.8
TI-2024-22066 File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to… CVSS 3.1HIGH 8.0
TI-2025-36966 CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter CVSS 3.1MEDIUM 6.5
TI-2025-36897 CubeCart Session Not Invalidated After Password Change CVSS 3.1HIGH 7.1
TI-2025-36965 CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement CVSS 3.1MEDIUM 5.4
TI-2025-36964 CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry CVSS 3.1MEDIUM 5.4

See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences