CVE-2012-2731
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the...
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
Exploit likelihood
What each source reports
NVD Score used
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
- Record
CVE-2012-2731- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
- Record
CVE-2012-2731- Updated
- 2026-11-02
EUVDEUVD-2012-2711 No score
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
- Record
EUVD-2012-2711- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cwq8-5gf7-6jfp No score
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the...
The Ubercart AJAX Cart 6.x-2.x before 6.x-2.1 for Drupal stores the PHP session id in the JavaScript settings array in page loads, which might allow remote attackers to obtain sensitive information by sniffing or reading the cache of the HTML of a webpage.
- Record
GHSA-cwq8-5gf7-6jfp- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2731 is a low vulnerability (CVSS 2.6) in Richardo Ante Ubercart Ajax Cart, published June 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.14%, the 82nd percentile. No source names a fixed version.
References
drupalcode.org/project/uc_ajax_cart.git/commitdiff/b59cdd5
exchange.xforce.ibmcloud.com/vulnerabilities/76332
securityfocus.com/bid/53999
drupal.org/node/1633048
openwall.com/lists/oss-security/2012/06/14/3
nvd.nist.gov/vuln/detail/CVE-2012-2731
github.com/advisories/GHSA-cwq8-5gf7-6jfp