CVE-2012-2301 - Vulnerability Details - OpenCVE

The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00876.

Key SSVC decision points have not yet been added.

Vendors	Products
Ubercart	Ubercart

Configuration 1 [-]

OR	cpe:2.3:a:ubercart:ubercart:6.x-2.0:::::drupal::
	cpe:2.3:a:ubercart:ubercart:6.x-2.1:::::drupal::
	cpe:2.3:a:ubercart:ubercart:6.x-2.2:::::drupal::
	cpe:2.3:a:ubercart:ubercart:6.x-2.3:::::drupal::
	cpe:2.3:a:ubercart:ubercart:6.x-2.4:::::drupal::
	cpe:2.3:a:ubercart:ubercart:6.x-2.6:::::drupal::
	cpe:2.3:a:ubercart:ubercart:6.x-2.7:::::drupal::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2012-2294	The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer product classes" permission to execute arbitrary PHP code via unspecified vectors.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://drupal.org/node/1547506
http://drupal.org/node/1547508
http://drupal.org/node/1547674
http://secunia.com/advisories/48935
http://www.openwall.com/lists/oss-security/2012/05/03/1
http://www.openwall.com/lists/oss-security/2012/05/03/2
http://www.securityfocus.com/bid/53251

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2014-11-16T02:00:00

Updated: 2024-08-06T19:26:09.011Z

Reserved: 2012-04-19T00:00:00

Link: CVE-2012-2301

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2014-11-16T02:59:00.137

Modified: 2025-04-12T10:46:40.837

Link: CVE-2012-2301

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-04-25T00:00:00", "descriptions": [{"lang": "en", "value": "The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the \"administer product classes\" permission to execute arbitrary PHP code via unspecified vectors."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-11-16T01:57:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "[oss-security] 20120502 Re: CVE Request for Drupal contributed modules", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/05/03/2"}, {"tags": ["x_refsource_MISC"], "url": "http://drupal.org/node/1547506"}, {"name": "48935", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/48935"}, {"tags": ["x_refsource_MISC"], "url": "http://drupal.org/node/1547674"}, {"name": "[oss-security] 20120502 CVE Request for Drupal contributed modules", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/05/03/1"}, {"name": "53251", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/53251"}, {"tags": ["x_refsource_MISC"], "url": "http://drupal.org/node/1547508"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "ID": "CVE-2012-2301", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the \"administer product classes\" permission to execute arbitrary PHP code via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20120502 Re: CVE Request for Drupal contributed modules", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/05/03/2"}, {"name": "http://drupal.org/node/1547506", "refsource": "MISC", "url": "http://drupal.org/node/1547506"}, {"name": "48935", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/48935"}, {"name": "http://drupal.org/node/1547674", "refsource": "MISC", "url": "http://drupal.org/node/1547674"}, {"name": "[oss-security] 20120502 CVE Request for Drupal contributed modules", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/05/03/1"}, {"name": "53251", "refsource": "BID", "url": "http://www.securityfocus.com/bid/53251"}, {"name": "http://drupal.org/node/1547508", "refsource": "MISC", "url": "http://drupal.org/node/1547508"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:26:09.011Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20120502 Re: CVE Request for Drupal contributed modules", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/05/03/2"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://drupal.org/node/1547506"}, {"name": "48935", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/48935"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://drupal.org/node/1547674"}, {"name": "[oss-security] 20120502 CVE Request for Drupal contributed modules", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/05/03/1"}, {"name": "53251", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/53251"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://drupal.org/node/1547508"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-2301", "datePublished": "2014-11-16T02:00:00", "dateReserved": "2012-04-19T00:00:00", "dateUpdated": "2024-08-06T19:26:09.011Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ubercart:ubercart:6.x-2.0:*:*:*:*:drupal:*:*", "matchCriteriaId": "2BCBA1DC-F8A5-4F2F-9752-28CC6C8FFD2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ubercart:ubercart:6.x-2.1:*:*:*:*:drupal:*:*", "matchCriteriaId": "810AB8A1-2985-4CD1-B35E-7F4409681B5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ubercart:ubercart:6.x-2.2:*:*:*:*:drupal:*:*", "matchCriteriaId": "31A48AE4-6112-41DC-AA23-E41A9C998506", "vulnerable": true}, {"criteria": "cpe:2.3:a:ubercart:ubercart:6.x-2.3:*:*:*:*:drupal:*:*", "matchCriteriaId": "86215DE2-5454-4B5C-B8B6-AC6EC6AD428B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ubercart:ubercart:6.x-2.4:*:*:*:*:drupal:*:*", "matchCriteriaId": "8C60FC17-5C92-4816-9C1D-8F1175216A0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ubercart:ubercart:6.x-2.6:*:*:*:*:drupal:*:*", "matchCriteriaId": "5EA1FA09-3303-4CA4-AEEA-FD0E83BC787D", "vulnerable": true}, {"criteria": "cpe:2.3:a:ubercart:ubercart:6.x-2.7:*:*:*:*:drupal:*:*", "matchCriteriaId": "83C4A799-5ABE-47D6-83BF-828CFA44EC17", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ubercart module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the \"administer product classes\" permission to execute arbitrary PHP code via unspecified vectors."}, {"lang": "es", "value": "El m\u00f3dulo Ubercat 6.x-2.x anterior a 6.x-2.8 para Drupal permite a usuarios remotos autenticados con permisos de administraci\u00f3n de clases de productos ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de vectores no especificados."}], "id": "CVE-2012-2301", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-11-16T02:59:00.137", "references": [{"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://drupal.org/node/1547506"}, {"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://drupal.org/node/1547508"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://drupal.org/node/1547674"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/48935"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/05/03/1"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/05/03/2"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/53251"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://drupal.org/node/1547506"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://drupal.org/node/1547508"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://drupal.org/node/1547674"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/48935"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/05/03/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/05/03/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/53251"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}