CVE-2016-3952: High severity Web2py Web2py vulnerability
Published Feb 6, 2018
·Updated
Last updated 25 August 2025
Other sources
web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/templateexamples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.
— Launchpad
Affected Software
2 affected components
debian/web2py
Web2py Web2py<2.14.1
Event History
Feb 6, 2018
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:29 PM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:17 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·03:57 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2016-3952?
CVE-2016-3952 is a vulnerability in web2py before 2.14.1 that allows remote attackers to obtain environment variable values and gain administrative access.
2
How severe is CVE-2016-3952?
CVE-2016-3952 has a severity value of 7.8, which is classified as high.
3
How can I fix CVE-2016-3952?
To fix CVE-2016-3952, update web2py to version 2.14.1 or later.
4
Are there any remedies available for CVE-2016-3952?
Yes, updating web2py to version 2.14.1 or later is the recommended remedy for CVE-2016-3952.
5
What is the Common Weakness Enumeration (CWE) for CVE-2016-3952?
The CWE for CVE-2016-3952 is CWE-255.