PT-2017-7097 · Web2Py · Web2Py

Narendra Bhati · Publicado 2017-10-18 · Atualizado 2017-10-31 · CVE-2015-6961

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Web2py version 2.9.11

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved by manipulating a URL in the next parameter to the user/logout endpoint.

Recommendations For Web2py version 2.9.11, as a temporary workaround, consider restricting access to the user/logout endpoint or validating the next parameter to prevent redirects to unauthorized sites.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2015-6961

Produtos afetados

Web2Py

Referências · 7

• https://github.com/web2py/web2py/commit/e31a099cb3456fef471886339653430ae59056b0 · Correção
• https://github.com/web2py/web2py/issues/731 · Nota
• https://cve.org/CVERecord?id=CVE-2015-6961 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6961 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6961 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6961 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-6961 · Aviso do Fabricante