{"id":"CVE-2023-45158","aliases":["EUVD-2023-49465","GHSA-vx79-v9rq-vjp5","UBUNTU-CVE-2023-45158"],"status":"published","title":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is...","description":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04412,"percentile":0.91407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2023-10-16T07:53:52Z","modified":"2026-10-28T02:30:25Z","exploits":[{"source":"pocgithub","id":"yifanzhg/CVE-2023-45158","title":"yifanzhg/CVE-2023-45158","date":"2023-11-04","url":"https://github.com/yifanzhg/CVE-2023-45158"}],"affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"web2py","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.99.7-1","2.12.3-1","2.12.3-1ubuntu0.1"]}],"products":[{"vendor":"web2py","product":"web2py"}],"references":[{"url":"http://web2py.com/","tags":["x_transferred","Product","web","report"]},{"url":"http://web2py.com/init/default/download","tags":["x_transferred","Product","web","report"]},{"url":"https://github.com/web2py/web2py/commit/936e2260b0c34c44e2f3674a893e96d2a7fad0a3","tags":["x_transferred","Patch","fix","report"]},{"url":"https://jvn.jp/en/jp/JVN80476432/","tags":["x_transferred","Third Party Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45158","tags":["advisory"]},{"url":"https://jvn.jp/en/jp/JVN80476432"},{"url":"http://web2py.com"},{"url":"https://github.com/advisories/GHSA-vx79-v9rq-vjp5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45158.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-45158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-45158","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-45158","description":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.","status":"published","published":"2023-10-16T07:53:52.134Z","modified":"2024-09-18T14:02:11.09Z","updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49465","description":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.","status":"published","published":"2023-10-16T07:53:52Z","modified":"2024-09-18T14:02:11Z","cvss":[{"version":"","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"none"}],"updated_at":"2026-11-03T00:28:21.470786Z"}],"ghsa":[{"id":"GHSA-vx79-v9rq-vjp5","title":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is...","description":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.","status":"published","published":"2023-10-16T09:30:18Z","modified":"2024-04-04T08:39:39Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:57:00.19255Z"}],"nvd":[{"id":"CVE-2023-45158","description":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.","status":"published","published":"2023-10-16T08:15:09.99Z","modified":"2026-06-17T06:28:19.9Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:08:37.83429Z"}],"osv":[{"id":"UBUNTU-CVE-2023-45158","description":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.","status":"published","published":"2023-10-16T08:15:00Z","modified":"2025-10-24T05:02:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"CVE-2023-45158","description":"An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.","status":"published","published":"2023-10-16T07:53:52.134Z","modified":"2026-10-28T02:30:25.671940039Z","updated_at":"2026-11-02T15:44:33.792101Z"}]}}