CVE-2014-4650

critical · 9.8

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

9.8

CVSS

24.7%

EPSS (exploit prob.)

98th

EPSS percentile

2020-02-20

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
python	python	>= 2.7.0, < 2.7.8
python	python	>= 3.2.0, < 3.2.6
python	python	>= 3.3.0, < 3.3.6
python	python	>= 3.4.0, < 3.4.2
redhat	software_collections	all versions
redhat	enterprise_linux	5.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	7.0

Check a specific version with /api/v1/cve/match.

References

http://bugs.python.org/issue21766
http://openwall.com/lists/oss-security/2014/06/26/3
https://access.redhat.com/security/cve/cve-2014-4650
http://bugs.python.org/issue21766
http://openwall.com/lists/oss-security/2014/06/26/3
https://access.redhat.com/security/cve/cve-2014-4650

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-4650