CVE-2014-4650: Path Traversal
First published: Thu Feb 20 2020(Updated: )
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Python Programming Language | >=2.7.0<2.7.8 | |
| Python Programming Language | >=3.2.0<3.2.6 | |
| Python Programming Language | >=3.3.0<3.3.6 | |
| Python Programming Language | >=3.4.0<3.4.2 | |
| Redhat Software Collections | ||
| Red Hat Enterprise Linux | =5.0 | |
| Red Hat Enterprise Linux | =6.0 | |
| Red Hat Enterprise Linux | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2014-4650?
CVE-2014-4650 is a vulnerability in the CGIHTTPServer module in Python 2.7.5 and 3.3.4 that allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence.
What is the severity of CVE-2014-4650?
The severity of CVE-2014-4650 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2014-4650?
Python versions 2.7.5 to 2.7.8, 3.2.0 to 3.2.6, 3.3.0 to 3.3.6, and 3.4.0 to 3.4.2 are affected.
How can the vulnerability in CVE-2014-4650 be exploited?
The vulnerability can be exploited through crafted character sequences in URLs, allowing remote attackers to read script source code or conduct directory traversal attacks.
Are there any references available related to CVE-2014-4650?
Yes, there are references available for CVE-2014-4650. They can be found in the following links: http://bugs.python.org/issue21766, http://openwall.com/lists/oss-security/2014/06/26/3, https://access.redhat.com/security/cve/cve-2014-4650.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/remedy
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/event
- agent/author
- agent/first-publish-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/python
- canonical/python programming language
- version/python programming language/2.7.0
- version/python programming language/3.2.0
- version/python programming language/3.3.0
- version/python programming language/3.4.0
- vendor/redhat
- canonical/redhat software collections
- canonical/red hat enterprise linux
- version/red hat enterprise linux/5.0
- version/red hat enterprise linux/6.0
- version/red hat enterprise linux/7.0