CVE-2014-9026: Medium severity ubercart currency conversion vulnerability
The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9026?
CVE-2014-9026 has a moderate severity level that potentially allows unauthorized access to sensitive user order history information.
How do I fix CVE-2014-9026?
To fix CVE-2014-9026, upgrade the Ubercart module to version 7.x-3.7 or later.
Who is affected by CVE-2014-9026?
CVE-2014-9026 affects users of the Ubercart module for Drupal versions prior to 7.x-3.7 that allow authenticated users to view their order history.
What types of information can be exposed due to CVE-2014-9026?
CVE-2014-9026 may expose sensitive order history details to unauthorized users who have the "view own orders" permission.
Is CVE-2014-9026 still a concern for current Drupal installations?
Yes, if an installation is using an affected version of the Ubercart module prior to 7.x-3.7, CVE-2014-9026 remains a significant security concern.