CVE-2016-4808
HighSummary
Web2py versions 2.14.5 and below are affected by a CSRF (Cross Site Request Forgery) vulnerability, allowing an attacker to trick a logged-in user into performing unwanted actions. An attacker can deceive a victim into disabling the installed application simply by sending a URL.
Risk Assessment
This vulnerability could lead to unauthorized application shutdowns by logged-in users, potentially disrupting system operations and impacting data security.
Recommendation
It is recommended to upgrade Web2py to a version above 2.14.5 and implement additional protections against CSRF attacks.
Other vulnerabilities in Web2py
See all- CVE-2016-4806High
Web2py versions 2.14.5 and below is affected by a Local File Inclusion vulnerability, allowing a malicious user to access sensitive web server files.
- CVE-2016-10321Critical
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
Original NVD description (English source)
Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.