CVE-2016-4806
HighSummary
Web2py versions 2.14.5 and below is affected by a Local File Inclusion vulnerability, allowing a malicious user to access sensitive web server files.
Risk Assessment
Exploitation of this vulnerability could lead to the disclosure of confidential information, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade Web2py to a version above 2.14.5 to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Web2py
See all- CVE-2016-4808High
Web2py versions 2.14.5 and below are affected by a CSRF (Cross Site Request Forgery) vulnerability, allowing an attacker to trick a logged-in user into performing unwanted actions. An attacker can deceive a victim into disabling the installed application simply by sending a URL.
- CVE-2016-10321Critical
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
Original NVD description (English source)
Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files.