Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2014-4650
HistoryFeb 20, 2020 - 5:15 p.m.

CVE-2014-4650

2020-02-2017:15:12
CWE-22
[email protected]
web.nvd.nist.gov
6

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.263

Percentile

96.8%

JSON

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Affected configurations

Nvd
Node
pythonpythonRange2.7.0–2.7.8
OR
pythonpythonRange3.2.0–3.2.6
OR
pythonpythonRange3.3.0–3.3.6
OR
pythonpythonRange3.4.0–3.4.2
Node
redhatsoftware_collectionsMatch-
OR
redhatenterprise_linuxMatch5.0
OR
redhatenterprise_linuxMatch6.0
OR
redhatenterprise_linuxMatch7.0
VendorProductVersionCPE
pythonpython*cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
redhatsoftware_collections-cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
redhatenterprise_linux5.0cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
redhatenterprise_linux6.0cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
redhatenterprise_linux7.0cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Related

openvas 27
fedora 8
exploitdb 1
nessus 30
zdt 1
exploitpack 1
securityvulns 2
prion 1
packetstorm 1
debiancve 1
ubuntucve 1
cve 1
cvelist 1
mageia 1
amazon 2
f5 1
osv 10
ibm 3
oraclelinux 3
redhat 3
centos 2
ubuntu 1
veracode 5
suse 1
openvas
openvas
SUSE: Security Advisory (SUSE-SU-2014:1009-1)
2021-06-09 00:00:00
Fedora Update for python FEDORA-2014-14227
2014-11-10 00:00:00
Python CGIHTTPServer 2.7.x < 2.7.8, 3.2.x < 3.2.5, 3.3.x < 3.3.3, 3.4.x < 3.4.2 Multiple Vulnerabilities (Jun 2014) - Linux
2021-11-03 00:00:00
fedora
fedora
[SECURITY] Fedora 20 Update: python-2.7.5-15.fc20
2014-11-09 15:47:21
[SECURITY] Fedora 19 Update: python-2.7.5-15.fc19
2014-11-22 12:44:28
[SECURITY] Fedora 21 Update: python3-3.4.1-16.fc21
2014-11-10 06:36:31
exploitdb
exploitdb
Python CGIHTTPServer - Encoded Directory Traversal
2014-06-27 00:00:00
nessus
nessus
Fedora 19 : python-2.7.5-15.fc19 (2014-14266)
2014-11-24 00:00:00
openSUSE Security Update : python3 (openSUSE-SU-2014:1042-1)
2014-08-21 00:00:00
Fedora 20 : python-2.7.5-15.fc20 (2014-14227)
2014-11-10 00:00:00
zdt
zdt
Python CGIHTTPServer Encoded Path Traversal Vulnerability
2014-06-27 00:00:00
exploitpack
exploitpack
Python CGIHTTPServer - Encoded Directory Traversal
2014-06-27 00:00:00
securityvulns
securityvulns
[RT-SA-2014-008] Python CGIHTTPServer File Disclosure and Potential Code Execution
2014-10-15 00:00:00
python security vulnerabilities
2014-07-14 00:00:00
prion
prion
Directory traversal
2020-02-20 17:15:00
packetstorm
packetstorm
Python CGIHTTPServer File Disclosure / Code Execution
2014-06-27 00:00:00
debiancve
debiancve
CVE-2014-4650
2020-02-20 17:15:12
ubuntucve
ubuntucve
CVE-2014-4650
2014-06-25 00:00:00
cve
cve
CVE-2014-4650
2020-02-20 17:15:12
cvelist
cvelist
CVE-2014-4650
2020-02-20 16:01:22
mageia
mageia
Updated python & python3 packages fix two vulnerabilities
2014-07-09 02:35:18
amazon
amazon
Medium: python27
2014-11-05 12:15:00
Medium: python26
2015-12-14 10:00:00
f5
f5
K93278412 : Python and Jython vulnerabilities CVE-2014-1912 and CVE-2014-4650
2017-07-21 00:00:00
osv
osv
python3-3.5.1-3.8 on GA media
2024-06-15 00:00:00
libpython2_7-1_0-2.7.12-1.4 on GA media
2024-06-15 00:00:00
python311-3.11.0b1-1.1 on GA media
2024-06-15 00:00:00
ibm
ibm
Security Bulletin: Python vulnerabilities affect IBM SmartCloud Entry (CVE-2013-1752 CVE-2014-1912 CVE-2014-4650 CVE-2014-7185)
2020-07-19 00:49:12
Security Bulletin: Multiple vulnerabilities in Python affect PowerKVM
2018-06-18 01:30:44
Security Bulletin: Vulnerabilities in Python, rpcbind, SQLite affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance
2018-06-17 22:33:00
oraclelinux
oraclelinux
python security, bug fix, and enhancement update
2015-07-28 00:00:00
python security, bug fix, and enhancement update
2015-11-23 00:00:00
python27 security, bug fix, and enhancement update
2016-02-04 00:00:00
redhat
redhat
(RHSA-2015:1330) Moderate: python security, bug fix, and enhancement update
2015-07-22 00:00:00
(RHSA-2015:2101) Moderate: python security, bug fix, and enhancement update
2015-11-19 13:41:01
(RHSA-2015:1064) Moderate: python27 security, bug fix, and enhancement update
2015-06-04 00:00:00
centos
centos
python, tkinter security update
2015-07-26 14:11:19
python, tkinter security update
2015-11-30 19:48:49
ubuntu
ubuntu
Python vulnerabilities
2015-06-25 00:00:00
veracode
veracode
Sensitive Information Leakage
2019-05-02 05:39:25
Improper Input Validation
2019-05-02 05:39:24
Improper Input Validation
2019-05-02 05:39:24
suse
suse
Security update for python3 (important)
2020-01-21 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.263

Percentile

96.8%

JSON
Related for NVD:CVE-2014-4650
openvas27fedora8exploitdb1nessus30zdt1exploitpack1securityvulns2prion1packetstorm1debiancve1ubuntucve1cve1cvelist1mageia1amazon2f51osv10ibm3oraclelinux3redhat3centos2ubuntu1veracode5suse1