Vulnerability Details CVE-2014-4650
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.103
EPSS Ranking 92.7%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
Products affected by CVE-2014-4650
-
cpe:2.3:a:python:python:2.7.0
-
cpe:2.3:a:python:python:2.7.1
-
cpe:2.3:a:python:python:2.7.2
-
cpe:2.3:a:python:python:2.7.3
-
cpe:2.3:a:python:python:2.7.4
-
cpe:2.3:a:python:python:2.7.5
-
cpe:2.3:a:python:python:2.7.6
-
cpe:2.3:a:python:python:2.7.7
-
cpe:2.3:a:python:python:3.2.0
-
cpe:2.3:a:python:python:3.2.1
-
cpe:2.3:a:python:python:3.2.2
-
cpe:2.3:a:python:python:3.2.3
-
cpe:2.3:a:python:python:3.2.4
-
cpe:2.3:a:python:python:3.2.5
-
cpe:2.3:a:python:python:3.3.0
-
cpe:2.3:a:python:python:3.3.1
-
cpe:2.3:a:python:python:3.3.2
-
cpe:2.3:a:python:python:3.3.3
-
cpe:2.3:a:python:python:3.3.4
-
cpe:2.3:a:python:python:3.3.5
-
cpe:2.3:a:python:python:3.4.0
-
cpe:2.3:a:python:python:3.4.1
-
cpe:2.3:a:redhat:software_collections:-
-
cpe:2.3:o:redhat:enterprise_linux:5.0
-
cpe:2.3:o:redhat:enterprise_linux:6.0
-
cpe:2.3:o:redhat:enterprise_linux:7.0