Description

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Remediation

References

CVE-2014-4650

Related Vulnerabilities

Opencart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2013-1891)

WordPress Plugin OG Tags Cross-Site Request Forgery (2.0.1)

OpenSSL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2015-3195)

WordPress Plugin Event Calendar WD-Responsive Event Calendar Cross-Site Scripting (1.1.44)

WordPress Plugin Ivory Search-WordPress Search Unspecified Vulnerability (5.4.3)

Severity

Critical

Classification

CVE-2014-4650 CWE-22 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities