Ubercart Module for Drupal contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when passwords created by new customers are stored as plain text until a purchase is confirmed, which may allow a remote attacker to easily gain access to passwords.
Classification
Location:
Local Access Required
Attack Type:
Information Disclosure
Impact:
Loss of Confidentiality
Solution:
Upgrade
Exploit:
Exploit Private
Disclosure:
Vendor Verified
OSVDB:
Web Related
Solution
Upgrade to version 6.x-2.8 or 7.x-3.1 or higher, as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
