CVE Feed

    Dashboard / CVE / CVE-2022-33146

    CVE-2022-33146

    Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

    Published:Jun 27, 2022
    Last Modified:Nov 21, 2024
    EPS:Jun 27, 2022
    EPSS Score:0.00598
    CVSS Score:6.1

    Affected Products

    Vendor
    Web2py
    Product
    Web2py

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2026-25198 (CVSS 5.1) — web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. …
    CVE-2023-45158 (CVSS 9.8) — An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to u…
    CVE-2023-22432 (CVSS 6.1) — Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may …
    CVE-2016-3953 (CVSS 9.8) — The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via …
    CVE-2016-3954 (CVSS 5.5) — web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to ex…
    CVE-2016-3952 (CVSS 7.8) — web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variabl…
    CVE-2016-3957 (CVSS 9.8) — The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session in…
    CVE-2015-6961 (CVSS 6.1) — Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to ar…
    CVE-2016-10321 (CVSS 9.8) — web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote…
    CVE-2016-4808 (CVSS 8.8) — Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High