Cubecart CVE-2014-2341

MEDIUM

Improper Authentication (CWE-287)

2014-04-22 cve@mitre.org

Authentication Bypass Cubecart

6.8

CVSS 2.0 · NVD

Share

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

M

Confidentiality

P

Integrity

P

Availability

P

Lifecycle Timeline

1

CVE Published

Apr 22, 2014 - 13:06 cve.org

MEDIUM 6.8

DescriptionCVE.org

Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter.

AnalysisAI

Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. Session fixation vulnerability in CubeCart before 5.2.9 allows remote attackers to hijack web sessions via the PHPSESSID parameter. Affected products include: Cubecart. Version information: before 5.2.9.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.

More in Cubecart

View all

CVE-2013-1465 CRITICAL Act Now POC

The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to un

CVE-2024-34832 CRITICAL Act Now POC

Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a craf

CVE-2012-0865 MEDIUM This Month POC

Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitr

CVE-2024-33438 HIGH This Week POC

File Upload vulnerability in CubeCart before 6.5.5 allows an authenticated user to execute arbitrary code via a crafted

CVE-2015-6928 MEDIUM This Month POC

classes/admin.class.php in CubeCart 5.2.12 through 5.2.16 and 6.x before 6.0.7 does not properly validate that a passwor

CVE-2025-59413 MEDIUM This Month POC

CubeCart is an ecommerce software solution. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable

CVE-2026-44376 MEDIUM This Month POC

Reflected XSS in CubeCart v6 (prior to 6.7.0) enables unauthenticated remote attackers to execute arbitrary JavaScript i

CVE-2025-59411 MEDIUM This Month POC

CubeCart is an ecommerce software solution. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable

CVE-2025-59412 MEDIUM This Month POC

CubeCart is an ecommerce software solution. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable

CVE-2021-33394 MEDIUM This Month POC

Cubecart 6.4.2 allows Session Fixation. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo

CVE-2026-45053 CRITICAL Act Now

Remote code execution in CubeCart v6 prior to 6.7.0 allows API key holders with files:rw permission to upload PHP webshe

CVE-2026-44377 CRITICAL Act Now

Authenticated server-side template injection in CubeCart v6 before 6.7.0 lets administrators escape the Smarty template

Same weakness CWE-287 – Improper Authentication

View all

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2020-0688 HIGH POC

CVE-2023-46805 HIGH POC

CVE-2023-35078 CRITICAL POC

CVE-2015-1187 CRITICAL POC

CVE-2024-7593 CRITICAL POC

CVE-2017-7921 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

CVE-2014-2341 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy