Django REST framework

Lookup for vulnerabilities affecting packages.

Vulnerability_id VCID-4uf8-wq6e-cue9

Summary

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.

Aliases

alias	CVE-2023-45158

Fixed_packages

Affected_packages

url pkg:pypi/web2py@2.24.1

purl pkg:pypi/web2py@2.24.1

is_vulnerable true

affected_by_vulnerabilities

vulnerability	VCID-4uf8-wq6e-cue9

resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/web2py@2.24.1

References

reference_url	https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3
reference_id
reference_type
scores
url	https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3

reference_url	https://jvn.jp/en/jp/JVN80476432/
reference_id
reference_type
scores
url	https://jvn.jp/en/jp/JVN80476432/

reference_url	http://web2py.com/
reference_id
reference_type
scores
url	http://web2py.com/

reference_url	http://web2py.com/init/default/download
reference_id
reference_type
scores
url	http://web2py.com/init/default/download

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2023-45158
reference_id	CVE-2023-45158
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2023-45158

Weaknesses

cwe_id	1035
name	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.

cwe_id	78
name	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
description	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

cwe_id	937
name	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description	Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.

Exploits

Severity_range_score null

Exploitability null

Weighted_severity null

Risk_score null

Resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4uf8-wq6e-cue9

Vulnerability Instance