CVE-2014-4650: Path Traversal
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2014-4650?
CVE-2014-4650 is a vulnerability in the CGIHTTPServer module in Python 2.7.5 and 3.3.4 that allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence.
What is the severity of CVE-2014-4650?
The severity of CVE-2014-4650 is critical with a CVSS score of 9.8.
Which software versions are affected by CVE-2014-4650?
Python versions 2.7.5 to 2.7.8, 3.2.0 to 3.2.6, 3.3.0 to 3.3.6, and 3.4.0 to 3.4.2 are affected.
How can the vulnerability in CVE-2014-4650 be exploited?
The vulnerability can be exploited through crafted character sequences in URLs, allowing remote attackers to read script source code or conduct directory traversal attacks.
Are there any references available related to CVE-2014-4650?
Yes, there are references available for CVE-2014-4650. They can be found in the following links: http://bugs.python.org/issue21766, http://openwall.com/lists/oss-security/2014/06/26/3, https://access.redhat.com/security/cve/cve-2014-4650.