CVE-2023-22432

Published: Mar 6, 2023Modified: Mar 7, 2025

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

Affected (1)

Products: Web2py: Web2py

Web2py

1 product

Web2py

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Web2py Web2py	Before 2.23.1

Related CWEs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (6)

http://web2py.com/

Source: vultures@jpcert.or.jp

Product

http://web2py.com/init/default/download

Source: vultures@jpcert.or.jp

Product

https://jvn.jp/en/jp/JVN78253670/

Source: vultures@jpcert.or.jp

Third Party Advisory

http://web2py.com/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

http://web2py.com/init/default/download

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://jvn.jp/en/jp/JVN78253670/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.