PT-2017-8534 · Web2Py · Web2Py

Narendra Bhati · Published 2017-01-11 · Updated 2022-05-17 · CVE-2016-4808

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Web2py versions 2.14.5 and below

Description The issue allows an attacker to trick a logged-in user, potentially an administrator, into performing unwanted actions. This can be achieved by sending a URL to the victim or by having them visit a specific URL, which can lead to actions such as disabling an installed application.

Recommendations For Web2py versions 2.14.5 and below, consider implementing CSRF protection mechanisms to prevent attackers from tricking users into performing unwanted actions. As a temporary workaround, restrict access to sensitive application functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-4808

GHSA-GP69-XCM6-FFQJ

Affected Products

Web2Py

References · 6

• 🔥 https://exploit-db.com/exploits/39821 · Exploit
• 🔥 http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-4808 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4808 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gp69-xcm6-ffqj · Vendor Advisory
• https://github.com/web2py/web2py · Note