Vulnerability · Published Jun 27, 2022 · Assigned by jpcert

CVE-2022-33146

Medium 6.1

In plain English

A medium-severity security flaw in web2py from web2py. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium

Exploit odds (30 days)1.9%top 20.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	web2py	2.22.5	GHSA-cgrj-xjm7-9q27
PyPI	web2py	2.22.5	PYSEC-2026-1060

Affected products (as reported)

Vendor	Product	Versions
web2py	web2py	versions prior to 2.22.5

References

http://web2py.com/ x_refsource_MISC
https://github.com/web2py/web2py/commit/d9805606f88f00c0be56438247605cefde73e14e#diff-c1d01f37ee54d813815718760b9c4d7b274e2be7ad18f65552cd564336ab593bR110 x_refsource_MISC
https://github.com/web2py/web2py/commit/a181b855a43cb8b479d276b082cfcde385768451 x_refsource_MISC
https://jvn.jp/en/jp/JVN02158640/index.html x_refsource_MISC