CVE-2014-4650
Critical
Description
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
SeverityCritical
CVSS9.8
Exploit probability98. percentile23.9%
Product
Python
PublishedFeb 20, 2020
First seenFeb 20, 2020
How to fix
Update
- python python2.7.8, 3.2.6, 3.3.6, 3.4.2 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python python | 2.7.0 ≤ v < 2.7.8, 3.2.0 ≤ v < 3.2.6, 3.3.0 ≤ v < 3.3.6, 3.4.0 ≤ v < 3.4.2 | 2.7.8, 3.2.6, 3.3.6, 3.4.2 |
| redhat software_collections | No range specified | — |
| redhat enterprise_linux | 5.0, 6.0, 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.