CVE search · CVE-2014-4650
CVE-2014-4650
critical 9.8
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Details
- Status
- Modified
- Published
- Last changed
- Source
- cve@mitre.org
- Weakness
- CWE-22
Severity
| Version | Score | Vector | Source |
|---|---|---|---|
| CVSS 3.1 | critical 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
nvd@nist.govPrimary |
| CVSS 2.0 | high 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
nvd@nist.govPrimary |
Affected products
Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.
References
- http://bugs.python.org/issue21766ExploitPatchVendor Advisory
- http://openwall.com/lists/oss-security/2014/06/26/3Mailing ListThird Party Advisory
- https://access.redhat.com/security/cve/cve-2014-4650Third Party Advisory
- http://bugs.python.org/issue21766ExploitPatchVendor Advisory
- http://openwall.com/lists/oss-security/2014/06/26/3Mailing ListThird Party Advisory
- https://access.redhat.com/security/cve/cve-2014-4650Third Party Advisory