CVE-2009-4773: Cross-site request forgery (CSRF) vulnerability in the order-management functionality in the Ubercart modul...

Security readout for executives and security teams

This is a CSRF flaw in Drupal Ubercart order management. If a logged-in victim is tricked through an unspecified vector, an attacker may cause actions under that victim's session. Business impact depends on who has order-management access and what actions their account can perform. Likely exposure is legacy Drupal installations running Ubercart 5.x before 5.x-1.9 or 6.x before 6.x-2.1, especially where staff use order-management features. Treat as a legacy e-commerce administration risk. Prioritize if Drupal Ubercart still processes orders or staff accounts can alter order records. Urgency is lower without known exploitation evidence, but unsupported legacy exposure should be removed. Mitigation focus: Upgrade Ubercart to 5.x-1.9, 6.x-2.1, or later supported guidance.; Identify all Drupal sites using the Ubercart module.; Restrict order-management access to staff who need it..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.