Ubuntu.comUB:CVE-2023-45158CVE-2023-45158
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
32.3%
An OS command injection vulnerability exists in web2py 2.24.1 and earlier.
When the product is configured to use notifySendHandler for logging (not
the default configuration), a crafted web request may execute an arbitrary
OS command on the web server using the product.
Notes
| Author | Note |
|---|---|
| Priority reason: Requires a non-default configuration to be vulnerable |
References
web2py.com/
web2py.com/init/default/download
github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
jvn.jp/en/jp/JVN80476432/
launchpad.net/bugs/cve/CVE-2023-45158
nvd.nist.gov/vuln/detail/CVE-2023-45158
security-tracker.debian.org/tracker/CVE-2023-45158
www.cve.org/CVERecord?id=CVE-2023-45158
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
32.3%