CVE-2023-45158

Published October 16th, 2023

View on NVD ↗

CVSS v3

9.8

CRITICAL

CVSS v2

N/A

Affected

PROJECT

Description

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

web2py/web2py

Free and open source full-stack enterprise framework for agile development of secure database-driven web-based applications, written and programmable in Python.

GitHub

2.17K