PT-2017-8534 · Web2Py · Web2Py

Narendra Bhati · Publicado 2017-01-11 · Atualizado 2022-05-17 · CVE-2016-4808

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web2py versions 2.14.5 and below

Description The issue allows an attacker to trick a logged-in user, potentially an administrator, into performing unwanted actions. This can be achieved by sending a URL to the victim or by having them visit a specific URL, which can lead to actions such as disabling an installed application.

Recommendations For Web2py versions 2.14.5 and below, consider implementing CSRF protection mechanisms to prevent attackers from tricking users into performing unwanted actions. As a temporary workaround, restrict access to sensitive application functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-4808

GHSA-GP69-XCM6-FFQJ

Produtos afetados

Web2Py

Referências · 6

• 🔥 https://exploit-db.com/exploits/39821 · Exploit
• 🔥 http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html · Exploit
• https://github.com/web2py/web2py · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4808 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-4808 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gp69-xcm6-ffqj · Aviso do Fabricante