PT-2017-7859 · Web2Py+1 · Web2Py+1

Published 2017-04-10 · Updated 2022-05-14 · CVE-2016-10321

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions web2py versions prior to 2.14.6

Description The issue allows a remote attacker to perform brute-force attacks due to improper checking of denied hosts before password verification.

Recommendations For versions prior to 2.14.6, update to version 2.14.6 or later to resolve the issue.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

CWE-254

Related Identifiers

CVE-2016-10321

GHSA-GV85-WGXC-VC56

USN-4030-1

Affected Products

Ubuntu

Web2Py

References · 16

• https://github.com/web2py/web2py/commit/944d8bd8f3c5cf8ae296fc03d149056c65358426 · Patch
• https://ubuntu.com/security/CVE-2016-10321 · Vendor Advisory
• https://usn.ubuntu.com/4030-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4030-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10321 · Security Note
• https://ubuntu.com/security/CVE-2016-3952 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4030-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gv85-wgxc-vc56 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3954 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3953 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3957 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-10321 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-10321 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-10321 · Security Note
• https://github.com/web2py/web2py · Note