web2py exposure of sensitive information

MEDIUM 5.5CVE-2016-3954 · GHSA-jr83-vr4j-mp6p · PYSEC-2026-1062 · Published 06/02/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
web2py PyPI	`< 2.14.2`	`2.14.2`
web2py web2py	`< 2.14.2`	`2.14.2`

Description

web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-3954 · ADVISORY
web2py/web2py commit 0820926 · WEB
devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957 · WEB
web2py/web2py · PACKAGE
usn.ubuntu.com/4030-1 · WEB
devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957 · Exploit
usn.ubuntu.com/4030-1
pypi.org/project/web2py · PACKAGE
GitHub Advisory GHSA-jr83-vr4j-mp6p · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free