PT-2022-21708 · Web2Py · Web2Py

Yuji Tounai · Published 2022-06-27 · Updated 2022-07-07 · CVE-2022-33146

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions web2py versions prior to 2.22.5

Description The issue allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having the user access a specially crafted URL. This can be achieved through an open redirect vulnerability.

Recommendations For versions prior to 2.22.5, update to version 2.22.5 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable URLs to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2022-33146

GHSA-CGRJ-XJM7-9Q27

Affected Products

Web2Py

References · 12

• https://github.com/web2py/web2py/commit/d9805606f88f00c0be56438247605cefde73e14e#diff-c1d01f37ee54d813815718760b9c4d7b274e2be7ad18f65552cd564336ab593bR110 · Patch
• https://github.com/web2py/web2py/commit/a181b855a43cb8b479d276b082cfcde385768451 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-33146 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-33146 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-33146 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-33146 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgrj-xjm7-9q27 · Vendor Advisory
• http://web2py.com · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-33146 · Security Note
• https://github.com/web2py/web2py · Note
• https://t.me/cibsecurity/45163 · Telegram Post
• https://jvn.jp/en/jp/JVN02158640/index.html · Note