CVE-2016-3954: web2py Sensitive Information Exposure Vulnerability
Summary
CVE-2016-3954: web2py exposure of sensitive information. Affects web2py versions < 2.14.2. Fixed in 2.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
web2py is a popular open-source web application framework written in Python, designed to facilitate the development of web applications quickly and easily. It provides a range of features including a built-in web-based interface, a database abstraction layer, and support for multiple database backends. However, prior to version 2.14.2, web2py had a vulnerability that allowed unauthorized access to sensitive information, specifically the session_cookie_key, which could be exploited by remote attackers.
Vulnerability Detail
The vulnerability identified as CVE-2016-3954 in web2py allows remote attackers to access the session_cookie_key value through a direct request to the endpoint examples/simple_examples/status. This exposure can lead to further exploitation, as attackers could leverage this information to execute arbitrary code, particularly in conjunction with another vulnerability identified as CVE-2016-3957. The risk is significant as it compromises the integrity and confidentiality of the application, potentially leading to unauthorized access and data breaches.
How To Fix
Latest published version: 2.1.1 as of 23 Oct 2026
pip install --upgrade "web2py==2.1.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.14.2
This is the first release that contains the fix.
pip install --upgrade "web2py==2.14.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the examples directory on your web server to prevent unauthorized requests. This can be done by configuring your web server settings to deny access to this directory until you can update the package.
Conclusion
The CVE-2016-3954 vulnerability in web2py poses a significant risk by exposing sensitive information that can be exploited by remote attackers. It is crucial to update to version 2.14.2 or later to mitigate this risk. Additionally, implementing temporary workarounds can help protect your application until the update is applied.
See every vulnerability recorded for web2py →
FAQ
CVE-2016-3954 is a vulnerability in web2py that allows remote attackers to access sensitive information, specifically the session_cookie_key.
Attackers can exploit this vulnerability by making a direct request to the examples/simple_examples/status endpoint, gaining access to the session_cookie_key.
The exposure of the session_cookie_key can lead to unauthorized access and execution of arbitrary code, compromising the application's security.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The CVSS score for CVE-2016-3954 is 5.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
