CVE-2023-45158

Summary

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

Affected Software

Weaknesses

• OS command injection

ADP Enrichment

CVE Program Container

Additional References

• http://web2py.com/
• http://web2py.com/init/default/download
• https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
• https://jvn.jp/en/jp/JVN80476432/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

• http://web2py.com/
• http://web2py.com/init/default/download
• https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
• https://jvn.jp/en/jp/JVN80476432/

• ←Previous
• Next→