CVE-2016-4807: Web2py Reflected XSS Vulnerability
Summary
CVE-2016-4807: Web2py Reflected XSS vulnerability. Affects web2py versions < 2.14.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Web2py is a popular open-source web application framework written in Python, designed to facilitate rapid development of web applications. It provides a robust set of features including a web-based interface, a built-in ticketing system, and support for multiple databases. However, versions 2.14.5 and below are vulnerable to a reflected cross-site scripting (XSS) attack, which can compromise the security of logged-in users, particularly administrators.
Vulnerability Detail
The vulnerability arises from inadequate input validation in Web2py, allowing attackers to inject malicious scripts into web pages viewed by users. When an admin user clicks on a crafted link, the injected script executes in their browser, potentially leading to unauthorized actions or data exposure. This vulnerability is classified as a reflected XSS, meaning the attack is executed immediately upon visiting the malicious link, making it particularly dangerous for users with elevated privileges.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to implement strict input validation and sanitization on user inputs to mitigate the risk of XSS attacks. Additionally, avoid clicking on untrusted links while logged in as an admin.
Conclusion
The reflected XSS vulnerability in Web2py versions 2.14.5 and below poses a significant risk to logged-in users, especially administrators. It is crucial to update to a patched version to mitigate this risk and ensure the security of your web applications.
See every vulnerability recorded for web2py →
FAQ
A reflected XSS vulnerability allows an attacker to inject malicious scripts into a web page, which are then executed in the browser of a user who clicks on a crafted link.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
If exploited, this vulnerability can lead to unauthorized access, data theft, or manipulation of user sessions, particularly affecting users with administrative privileges.
Yes, updating to a version of Web2py higher than 2.14.5 will patch this vulnerability.
The CVSS score for this vulnerability is 4.8, indicating a moderate level of risk.
Related vulnerabilities
Recent vulnerabilities recorded for web2py.
