Search for vulnerabilities
| Vulnerability ID | VCID-46e4-wwyz-3kb9 |
| Aliases |
CVE-2014-4650
|
| Summary | The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator. |
| Status | Published |
| Exploitability | 2.0 |
| Weighted Severity | 2.6 |
| Risk | 5.2 |
| Affected and Fixed Packages | Package Details |
| System | Score | Found at |
|---|---|---|
| epss | 0.07232 | https://api.first.org/data/v1/epss?cve=CVE-2014-4650 |
| epss | 0.07232 | https://api.first.org/data/v1/epss?cve=CVE-2014-4650 |
| epss | 0.07232 | https://api.first.org/data/v1/epss?cve=CVE-2014-4650 |
| epss | 0.07232 | https://api.first.org/data/v1/epss?cve=CVE-2014-4650 |
| cvssv3.1 | 5.3 | https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml |
| Reference id | Reference type | URL |
|---|---|---|
| https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-4650.json | ||
| https://api.first.org/data/v1/epss?cve=CVE-2014-4650 | ||
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650 | ||
| https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml | ||
| 1113527 | https://bugzilla.redhat.com/show_bug.cgi?id=1113527 | |
| CVE-2014-4650;OSVDB-108369 | Exploit | https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/33894.txt |
| CVE-2014-4650;OSVDB-108369 | Exploit | https://www.redteam-pentesting.de/advisories/rt-sa-2014-008 |
| RHSA-2015:1064 | https://access.redhat.com/errata/RHSA-2015:1064 | |
| RHSA-2015:1330 | https://access.redhat.com/errata/RHSA-2015:1330 | |
| RHSA-2015:2101 | https://access.redhat.com/errata/RHSA-2015:2101 | |
| USN-2653-1 | https://usn.ubuntu.com/2653-1/ |
| Data source | Exploit-DB |
|---|---|
| Date added | June 27, 2014 |
| Description | Python CGIHTTPServer - Encoded Directory Traversal |
| Ransomware campaign use | Known |
| Source publication date | June 27, 2014 |
| Exploit type | webapps |
| Platform | multiple |
| Source update date | June 27, 2014 |
| Source URL | https://www.redteam-pentesting.de/advisories/rt-sa-2014-008 |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
| Percentile | 0.91761 |
| EPSS Score | 0.07232 |
| Published At | June 4, 2026, 12:55 p.m. |
| Date | Actor | Action | Source | VulnerableCode Version |
|---|---|---|---|---|
| 2026-06-04T17:08:35.570691+00:00 | Debian Importer | Import | https://security-tracker.debian.org/tracker/data/json | 38.6.0 |