{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45158", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2023-10-04T23:39:17.361Z", "datePublished": "2023-10-16T07:53:52.134Z", "dateUpdated": "2024-09-18T14:02:11.090Z"}, "containers": {"cna": {"affected": [{"vendor": "web2py", "product": "web2py", "versions": [{"version": "2.24.1 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product."}], "problemTypes": [{"descriptions": [{"description": "OS command injection", "lang": "en", "type": "text"}]}], "references": [{"url": "http://web2py.com/"}, {"url": "http://web2py.com/init/default/download"}, {"url": "https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3"}, {"url": "https://jvn.jp/en/jp/JVN80476432/"}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-10-16T07:53:52.134Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:14:19.011Z"}, "title": "CVE Program Container", "references": [{"url": "http://web2py.com/", "tags": ["x_transferred"]}, {"url": "http://web2py.com/init/default/download", "tags": ["x_transferred"]}, {"url": "https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN80476432/", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-18T14:02:01.283678Z", "id": "CVE-2023-45158", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-18T14:02:11.090Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://web2py.com/", "tags": ["x_transferred"]}, {"url": "http://web2py.com/init/default/download", "tags": ["x_transferred"]}, {"url": "https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3", "tags": ["x_transferred"]}, {"url": "https://jvn.jp/en/jp/JVN80476432/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:14:19.011Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-45158", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-18T14:02:01.283678Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-18T14:02:07.331Z"}}], "cna": {"affected": [{"vendor": "web2py", "product": "web2py", "versions": [{"status": "affected", "version": "2.24.1 and earlier"}]}], "references": [{"url": "http://web2py.com/"}, {"url": "http://web2py.com/init/default/download"}, {"url": "https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3"}, {"url": "https://jvn.jp/en/jp/JVN80476432/"}], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "OS command injection"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2023-10-16T07:53:52.134Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45158", "state": "PUBLISHED", "dateUpdated": "2024-09-18T14:02:11.090Z", "dateReserved": "2023-10-04T23:39:17.361Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2023-10-16T07:53:52.134Z", "assignerShortName": "jpcert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:web2py:web2py:*:*:*:*:*:*:*:*", "matchCriteriaId": "804767C1-58E1-4770-88B5-08E840011736", "versionEndIncluding": "2.24.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product."}, {"lang": "es", "value": "Existe una vulnerabilidad de inyecci\u00f3n de comandos del Sistema Operativo en web2py 2.24.1 y versiones anteriores. Cuando el producto est\u00e1 configurado para utilizar notifySendHandler para el registro (no la configuraci\u00f3n predeterminada), una solicitud web manipulada puede ejecutar un comando arbitrario del sistema operativo en el servidor web que utiliza el producto."}], "id": "CVE-2023-45158", "lastModified": "2023-10-18T19:58:13.557", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-10-16T08:15:09.990", "references": [{"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "http://web2py.com/"}, {"source": "vultures@jpcert.or.jp", "tags": ["Product"], "url": "http://web2py.com/init/default/download"}, {"source": "vultures@jpcert.or.jp", "tags": ["Patch"], "url": "https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3"}, {"source": "vultures@jpcert.or.jp", "tags": ["Third Party Advisory"], "url": "https://jvn.jp/en/jp/JVN80476432/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}