CVEvulnerability

CVE-2014-4650

9.8 CRITICAL Published 2020-02-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-02-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-22

Description

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Affected configurations

• python python (>= 2.7.0 < 2.7.8) • python python (>= 3.2.0 < 3.2.6) • python python (>= 3.3.0 < 3.3.6) • python python (>= 3.4.0 < 3.4.2) • redhat software collections • redhat enterprise linux 5.0 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References