VulnerabilityModified

CVE-2023-45158

An OS command injection vulnerability exists in web2py 2.24.1 and earlier.

CRITICAL 9.8EPSS 3.69%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.69%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 3.69% probability · 89th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: web2py/web2py
Source: vultures@jpcert.or.jp

References

http://web2py.com/Product
http://web2py.com/init/default/downloadProduct
https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3Patch
https://jvn.jp/en/jp/JVN80476432/Third Party Advisory
http://web2py.com/Product
http://web2py.com/init/default/downloadProduct
https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3Patch
https://jvn.jp/en/jp/JVN80476432/Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.