GitHub Advisoryadvisory · PyPI

GHSA-jr83-vr4j-mp6p web2py exposure of sensitive information

MEDIUM Published 2022-05-14 Modified 2023-11-22 Official page ↗
Aliases
CVE-2016-3954
Ecosystem
PyPI
Packages
web2py
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-07-28

Affected packages

• PyPI web2py: < 2.14.2 → fixed in 2.14.2

Description

web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.

Related

Alias · CVE (1)

  • CVE-2016-3954 web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References