Web2py Cross-Site Request Forgery vulnerability

ALTO 8.8CVE-2016-4808 · GHSA-gp69-xcm6-ffqj · PYSEC-2026-1061 · Published 11/01/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
web2py PyPI	`< 2.14.6`	`2.14.6`
web2py web2py	`≤ 2.14.5`	No fix yet

Description

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged-in administrator into performing unwanted actions i.e An attacker can trick a victim into disable the installed application just by visiting a URL.

NVD description

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.

References

nvd.nist.gov/vuln/detail/CVE-2016-4808 · ADVISORY
web2py/web2py · PACKAGE
exploit-db.com/exploits/39821 · WEB
packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html · WEB
exploit-db.com/exploits/39821 · Exploit
pypi.org/project/web2py · PACKAGE
GitHub Advisory GHSA-gp69-xcm6-ffqj · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free