p PatchFirst

CVE-2023-45158

CVE-2023-45158

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

CVSS 9.8 · Critical · EPSS 4.4%

Published
Updated

Stack: system

Affected products and versions

  • web2py

    Versions
    • 2.24.1 and earlier: Affected

    No fix published

  • web2py Ubuntu:16.04:LTS

    Versions
    • 1.99.7-1
    • 2.12.3-1
    • 2.12.3-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →