CVE-2016-3954 describes an information disclosure vulnerability in web2py versions prior to 2.14.2, allowing remote attackers to retrieve the session_cookie_key by directly requesting the examples/simple_examples/status page. This vulnerability has a CVSS score of 5.5 (Medium), indicating a low attack complexity and local privileges required, but a high impact on confidentiality. While not actively exploited in the wild, this information disclosure can be chained with CVE-2016-3957 to achieve arbitrary code execution. There is no known public exploit code, Metasploit module, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.14.2CPE matchmatch criteria | cpe:2.3:a:web2py:web2py:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.