CVE-2016-10321
CriticalSummary
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
Risk Assessment
An attacker can exploit this vulnerability to gain unauthorized access to user accounts through password guessing attempts, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade web2py to version 2.14.6 or later to secure the system against these attacks.
Other vulnerabilities in web2py
See all- CVE-2016-4808High
Web2py versions 2.14.5 and below are affected by a CSRF (Cross Site Request Forgery) vulnerability, allowing an attacker to trick a logged-in user into performing unwanted actions. An attacker can deceive a victim into disabling the installed application simply by sending a URL.
- CVE-2016-4806High
Web2py versions 2.14.5 and below is affected by a Local File Inclusion vulnerability, allowing a malicious user to access sensitive web server files.
Original NVD description (English source)
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.