GitHub Advisoryadvisory · PyPI

GHSA-gv85-wgxc-vc56 web2py is vulnerable to password brute-force attack

CRITICAL Published 2022-05-14 Modified 2023-08-03 Official page ↗
Aliases
CVE-2016-10321
Ecosystem
PyPI
Packages
web2py
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-307
Reviewed
2023-08-03

Affected packages

• PyPI web2py: < 2.14.6 → fixed in 2.14.6

Description

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.

Related

Alias · CVE (1)

  • CVE-2016-10321 web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform… vulnerability

Weakness · CWE (1)

  • CWE-307 Improper Restriction of Excessive Authentication Attempts weakness

References