PatchTheCVEubercart vulnerabilities and fixes
Recent CVEs affecting ubercart, with upgrade or downgrade steps. 9 tracked.
ubercart has 9 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2014-11-20. Highest priority: CVE-2013-7302 (score 42/100).
- CVE-2014-9026 MEDIUM 4.0 DOWNGRADE The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history vie
- CVE-2013-7302 MEDIUM 6.8 DOWNGRADE Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for D
- CVE-2013-0322 MEDIUM 4.3 DOWNGRADE Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal all
- CVE-2012-5804 MEDIUM 5.8 MITIGATE MITIGATE The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subje
- CVE-2012-5803 MEDIUM 5.8 MITIGATE MITIGATE The Authorize.Net module in Ubercart does not verify that the server hostname matches a domain name in the sub
- CVE-2012-5802 MEDIUM 5.8 MITIGATE MITIGATE The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's
- CVE-2012-2301 MEDIUM 6.0 DOWNGRADE The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer p
- CVE-2012-2300 LOW 2.1 DOWNGRADE Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x
- CVE-2012-2299 LOW 2.1 DOWNGRADE The Ubercart module 6.x-2.x before 6.x-2.8 and 7.x-3.x before 7.x-3.1 for Drupal stores passwords for new cust
FAQ
How do I fix ubercart vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is ubercart being exploited right now?
None of the tracked ubercart CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which ubercart CVE should I patch first?
CVE-2013-7302 currently ranks highest (42/100): Session fixation vulnerability in the Ubercart module 6.x-2.x before 6.x-2.13 and 7.x-3.x before 7.x-3.6 for D.