CVE Feed

    Dashboard / CVE / CVE-2016-3952

    CVE-2016-3952

    web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.

    Published:Feb 6, 2018
    Last Modified:Nov 21, 2024
    EPS:Feb 6, 2018
    EPSS Score:0.00397
    CVSS Score:7.8

    Affected Products

    Vendor
    Web2py
    Product
    Web2py

    Exploits

    https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-25198 (CVSS 5.1) — web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. …
    CVE-2023-45158 (CVSS 9.8) — An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to u…
    CVE-2023-22432 (CVSS 6.1) — Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may …
    CVE-2022-33146 (CVSS 6.1) — Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to …
    CVE-2016-3953 (CVSS 9.8) — The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via …
    CVE-2016-3954 (CVSS 5.5) — web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to ex…
    CVE-2016-3957 (CVSS 9.8) — The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session in…
    CVE-2015-6961 (CVSS 6.1) — Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to ar…
    CVE-2016-10321 (CVSS 9.8) — web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote…
    CVE-2016-4808 (CVSS 8.8) — Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High