Web2py Cross-Site Request Forgery vulnerability

高 8.8CVE-2016-4808 · GHSA-gp69-xcm6-ffqj · PYSEC-2026-1061 · 11/01/2017 公開 · 17/06/2026 更新

パッケージ	影響を受けるバージョン	修正済みバージョン
web2py PyPI	`< 2.14.6`	`2.14.6`
web2py web2py	`≤ 2.14.5`	修正版なし

概要

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged-in administrator into performing unwanted actions i.e An attacker can trick a victim into disable the installed application just by visiting a URL.

NVD の説明

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.

参考情報

nvd.nist.gov/vuln/detail/CVE-2016-4808 · ADVISORY
web2py/web2py · PACKAGE
exploit-db.com/exploits/39821 · WEB
packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html · WEB
exploit-db.com/exploits/39821 · Exploit
pypi.org/project/web2py · PACKAGE
GitHub Advisory GHSA-gp69-xcm6-ffqj · ADVISORY

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン