CVE-2023-45158

2023-10-1607:53:52

jpcert

www.cve.org

vulnerability

web2py

os command injection

notifysendhandler

web server

crafted web request

arbitrary command execution

EPSS

0.001

Percentile

37.2%

JSON

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

CNA Affected

[
  {
    "vendor": "web2py",
    "product": "web2py",
    "versions": [
      {
        "version": "2.24.1 and earlier",
        "status": "affected"
      }
    ]
  }
]