CVE Feed

    Dashboard / CVE / CVE-2023-22432

    CVE-2023-22432

    Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

    Published:Mar 5, 2023
    Last Modified:Mar 7, 2025
    EPS:Mar 5, 2023
    EPSS Score:0.38217
    CVSS Score:6.1

    Affected Products

    Vendor
    Web2py
    Product
    Web2py

    Exploits

    https://github.com/aeyesec/CVE-2023-22432

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2026-25198 (CVSS 5.1) — web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. …
    CVE-2023-45158 (CVSS 9.8) — An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to u…
    CVE-2022-33146 (CVSS 6.1) — Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to …
    CVE-2016-3953 (CVSS 9.8) — The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via …
    CVE-2016-3954 (CVSS 5.5) — web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to ex…
    CVE-2016-3952 (CVSS 7.8) — web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variabl…
    CVE-2016-3957 (CVSS 9.8) — The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session in…
    CVE-2015-6961 (CVSS 6.1) — Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to ar…
    CVE-2016-10321 (CVSS 9.8) — web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote…
    CVE-2016-4808 (CVSS 8.8) — Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High