CyberRota Analysis
AI-GeneratedWeb.py version 0.76 is vulnerable due to insufficient session expiration, allowing attackers to exploit expired session cookies that have not been properly cleaned up. This flaw enables unauthorized access to protected resources beyond the intended idle timeout, posing a risk to applications relying on this framework. Developers and organizations using web.py should prioritize remediation to safeguard against potential session hijacking attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can still be replayed and used, allowing an attacker holding a previously valid session cookie to continue accessing protected resources after the configured idle timeout.