CVE-2016-4808: Web2py Cross-Site Request Forgery vulnerability
Summary
CVE-2016-4808: Web2py Cross-Site Request Forgery vulnerability. Affects web2py versions < 2.14.6. Fixed in 2.14.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Web2py is an open-source web application framework written in Python. It provides a simple and secure way to develop web applications. The framework offers features such as automatic form generation, database abstraction, and a built-in web-based administrative interface. However, versions 2.14.5 and below of Web2py are vulnerable to a Cross-Site Request Forgery (CSRF) attack.
Vulnerability Detail
The CSRF vulnerability in Web2py allows an attacker to trick a logged-in administrator into performing unwanted actions. By exploiting this vulnerability, an attacker can deceive a victim into disabling the installed application simply by visiting a malicious URL. This can lead to unauthorized changes to the application's configuration and potentially disrupt its functionality.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
pip install --upgrade "web2py==2.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.6
This is the first release that contains the fix.
pip install --upgrade "web2py==2.14.6"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, as a general best practice, developers can implement CSRF protection measures such as using anti-CSRF tokens, checking the Referer header, and employing strict access control mechanisms to mitigate the risk of CSRF attacks.
Conclusion
The CSRF vulnerability in Web2py versions 2.14.5 and below can be exploited by attackers to trick administrators into performing unintended actions. To mitigate this vulnerability, it is crucial to upgrade to Web2py version 2.14.6 or above. Developers should also consider implementing additional CSRF protection measures to enhance the security of their applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for web2py →
FAQ
Web2py is an open-source web application framework written in Python. It provides a simple and secure way to develop web applications.
A CSRF vulnerability allows an attacker to trick a logged-in user into performing unwanted actions without their consent or knowledge.
The CSRF vulnerability in Web2py can be exploited to deceive administrators into performing unintended actions, such as disabling the installed application.
To mitigate the CSRF vulnerability, it is advised to upgrade to Web2py version 2.14.6 or above, which includes security patches addressing the issue.
While no specific workarounds are mentioned, developers can implement CSRF protection measures such as anti-CSRF tokens and strict access control mechanisms.
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
