CVE-2023-45158

State: Published
Severity: Not scored
Published: Oct 16, 2023
Updated: Sep 18, 2024
Reserved: Oct 4, 2023

Description

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
web2pyweb2py	2.24.1 and earlierAffected

References

http://web2py.com/
http://web2py.com/init/default/download
https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
https://jvn.jp/en/jp/JVN80476432/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.