Web2py 漏洞列表

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

该漏洞为Web2PY 2.24.1之前版本的OS命令注入漏洞。当用户没采用默认配置，其配置文件中使用NotifySendHandler进行登录（不是默认配置）时，攻击者可精心设计的Web请求可以使用产品在Web服务器上执行任意OS命令。