CVE-2016-3952 Information disclosure in n/a
Remote attackers can obtain environment variables and gain administrative access in standalone web2py installations via a specific endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-3952?
CVE-2016-3952 is a high-severity vulnerability in n/a, published on 6 Feb 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.
Weakness: CWE-255
Which versions are affected by CVE-2016-3952?
It affects 1 product.
Products include Web2py Web2py.
How do I fix CVE-2016-3952?
Upgrade to a fixed version.
Is CVE-2016-3952 being exploited?
There is no known exploitation of CVE-2016-3952 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-45158 Command injection in web2py
- CVE-2016-3953 web2py remote code execution via hardcoded encryption key in session.connect function
- CVE-2016-3957 Deserialization in n/a
- CVE-2016-10321 web2py is vulnerable to password brute-force attack
- CVE-2016-4808 Web2py Cross-Site Request Forgery vulnerability
Sources
Also known as GHSA-jpvh-fwvr-cpwh, UBUNTU-CVE-2016-3952.