-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| web2py | pip | <= 2.14.5 | 2.14.6 |
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability specifically involves CSRF in application disable functionality via crafted URLs. Web2py's admin interface typically maps URLs to controller functions, and the exploit URL path '/admin/default/enable/[appname]' directly points to the 'enable' function in the admin controller. The function's acceptance of state-changing operations (enable/disable) via GET requests without CSRF tokens matches the described attack vector. Web2py's security model normally requires CSRF protection for state-changing actions, indicating this function lacked proper @request.restrict() decorators or CSRF validation checks in vulnerable versions.
Ongoing coverage of React2Shell