CVE-2023-45158
CRITICAL 9.8EPSS 4.4%
An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
- Affected
- web2py
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 4.41% chance of exploitation in the next 30 days, 91st percentile
- Published
- 2023-10-16
- Updated
- 2024-09-18
Proof-of-concept exploits (1)
- Evan-Zhangyf/CVE-2023-451584★ · 2023-11-04
Security advisories
- https://jvn.jp/en/jp/JVN80476432
- web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
- http://web2py.com
- http://web2py.com/init/default/download