CVE-2014-9026

The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ubercart:ubercart:7.x-3.0:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:alpha1:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:alpha2:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:alpha3:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:beta1:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:beta2:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:beta3:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:beta4:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:rc1:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:rc2:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:rc3:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.0:rc4:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.1:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.2:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.3:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.4:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.5:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.6:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.7:*:*:*:*:drupal:*:*
cpe:2.3:a:ubercart:ubercart:7.x-3.x-dev:*:*:*:*:drupal:*:*

History

No history.

Information

Published : 2014-11-20 17:50

Updated : 2024-02-28 12:20


NVD link : CVE-2014-9026

Mitre link : CVE-2014-9026

CVE.ORG link : CVE-2014-9026


JSON object : View

Products Affected

ubercart

  • ubercart
CWE
CWE-264

Permissions, Privileges, and Access Controls