PT-2017-7097 · Web2Py · Web2Py

Narendra Bhati · Published 2017-10-18 · Updated 2017-10-31 · CVE-2015-6961

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Web2py version 2.9.11

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved by manipulating a URL in the next parameter to the user/logout endpoint.

Recommendations For Web2py version 2.9.11, as a temporary workaround, consider restricting access to the user/logout endpoint or validating the next parameter to prevent redirects to unauthorized sites.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2015-6961

Affected Products

Web2Py

References · 7

• https://github.com/web2py/web2py/commit/e31a099cb3456fef471886339653430ae59056b0 · Patch
• https://cve.org/CVERecord?id=CVE-2015-6961 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6961 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-6961 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-6961 · Vendor Advisory
• https://github.com/web2py/web2py/issues/731 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6961 · Note