CVE-2013-7302: Medium severity Ubercart Ubercart vulnerability
Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for Drupal, when the "Log in new customers after checkout" option is enabled, allows remote attackers to hijack web sessions by leveraging knowledge of the original session ID.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ubercart (Drupal module)to a version that resolves this vulnerability.Fixed in 6.x-2.13 - Upgrade
Upgrade
Ubercart (Drupal module)to a version that resolves this vulnerability.Fixed in 7.x-3.6 - Configuration
Disable the 'Log in new customers after checkout' option in the Ubercart module to prevent the session fixation issue when enabled.
Ubercart (Drupal module) Log in new customers after checkout = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7302?
CVE-2013-7302 is classified as a moderate severity vulnerability.
How do I fix CVE-2013-7302?
To fix CVE-2013-7302, update your Ubercart module to version 6.x-2.13 or 7.x-3.6 or later.
What is affected by CVE-2013-7302?
CVE-2013-7302 affects Ubercart versions 6.x-2.x prior to 6.x-2.13 and 7.x-3.x prior to 7.x-3.6.
Can CVE-2013-7302 lead to session hijacking?
Yes, CVE-2013-7302 allows attackers to hijack web sessions through session fixation.
What versions of Ubercart need attention for CVE-2013-7302?
Versions 6.x-2.0 to 6.x-2.12 and 7.x-3.0 to 7.x-3.5 of Ubercart are affected by CVE-2013-7302.