CVE Catalog
CVE-2016-10321
CriticalSummary
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
Risk Assessment
An attacker can exploit this vulnerability to gain unauthorized access to user accounts through password guessing attempts, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade web2py to version 2.14.6 or later to secure the system against these attacks.
Original NVD description (English source)
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.