Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-8jfv-cqa8-7yb6
Vulnerability ID VCID-8jfv-cqa8-7yb6
Aliases CVE-2014-4650
Summary python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs
Status Published
Exploitability 2.0
Weighted Severity 2.6
Risk 5.2
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-138 Improper Neutralization of Special Elements
System Score Found at
epss 0.06019 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.06019 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.06019 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07232 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-4650.json
https://api.first.org/data/v1/epss?cve=CVE-2014-4650
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
1113527 https://bugzilla.redhat.com/show_bug.cgi?id=1113527
CVE-2014-4650;OSVDB-108369 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/33894.txt
CVE-2014-4650;OSVDB-108369 Exploit https://www.redteam-pentesting.de/advisories/rt-sa-2014-008
RHSA-2015:1064 https://access.redhat.com/errata/RHSA-2015:1064
RHSA-2015:1330 https://access.redhat.com/errata/RHSA-2015:1330
RHSA-2015:2101 https://access.redhat.com/errata/RHSA-2015:2101
USN-2653-1 https://usn.ubuntu.com/2653-1/
Data source Exploit-DB
Date added June 27, 2014
Description Python CGIHTTPServer - Encoded Directory Traversal
Ransomware campaign use Known
Source publication date June 27, 2014
Exploit type webapps
Platform multiple
Source update date June 27, 2014
Source URL https://www.redteam-pentesting.de/advisories/rt-sa-2014-008
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.9067
EPSS Score 0.06019
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T14:47:36.610582+00:00 RedHat Importer Import https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-4650.json 38.0.0