CVE-2016-3957

The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to...

9.8 CriticalPublic exploitFix available

CVE-2016-3957 is a critical vulnerability (CVSS 9.8) in Web2py, published February 6, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.94%, the 92nd percentile. Fixed in web2py 2.12.3-1ubuntu0.1.

The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.94%Down 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2016-3957
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-502
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-3957
Updated: 2026-11-02

EUVDEUVD-2016-4966 No score

Record: EUVD-2016-4966
Updated: 2026-11-03

GitHub AdvisoriesGHSA-p6rg-cchx-f5x4 9.8

The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to...

Record: GHSA-p6rg-cchx-f5x4
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-502
Updated: 2026-11-02

OSV 9.8

Record: CVE-2016-3957
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-3957 9.8

Record: UBUNTU-CVE-2016-3957
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUSN-4030-1 No score

web2py vulnerabilities

It was discovered that web2py does not properly check denied hosts before verifying passwords. An attacker could possibly use this issue to perform brute-force attacks. (CVE-2016-10321)

It was discovered that web2py allows remote attackers to obtain environment variable values. An attacker could possibly use this issue to gain administrative access. (CVE-2016-3952)

It was discovered that web2py uses a hardcoded encryption key. An attacker could possibly use this issue to execute arbitrary code. (CVE-2016-3953, CVE-2016-3954, CVE-2016-3957)

Record: USN-4030-1
Updated: 2026-11-02