Search for vulnerabilities
Vulnerability details: VCID-nagf-8bav-aaas
Vulnerability ID VCID-nagf-8bav-aaas
Aliases CVE-2014-4650
Summary The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Status Published
Exploitability 2.0
Weighted Severity 8.8
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-138 Improper Neutralization of Special Elements
System Score Found at
generic_textual Low http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-4650.html
rhas Moderate https://access.redhat.com/errata/RHSA-2015:1064
rhas Moderate https://access.redhat.com/errata/RHSA-2015:1330
rhas Moderate https://access.redhat.com/errata/RHSA-2015:2101
epss 0.04364 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.05655 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07756 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.07756 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.10304 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.16260 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.16260 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17116 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
epss 0.17378 https://api.first.org/data/v1/epss?cve=CVE-2014-4650
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1113527
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2014-4650
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2014-4650
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2014-4650
generic_textual Medium https://ubuntu.com/security/notices/USN-2653-1
generic_textual Low http://www.openwall.com/lists/oss-security/2014/06/26/3
Reference id Reference type URL
http://bugs.python.org/issue21766
http://openwall.com/lists/oss-security/2014/06/26/3
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-4650.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2014-4650.json
https://access.redhat.com/security/cve/cve-2014-4650
https://api.first.org/data/v1/epss?cve=CVE-2014-4650
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4650
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://ubuntu.com/security/notices/USN-2653-1
http://www.openwall.com/lists/oss-security/2014/06/26/3
1113527 https://bugzilla.redhat.com/show_bug.cgi?id=1113527
cpe:2.3:a:python:python:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:2.7.5:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.3.4:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:python:python:3.3.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:software_collections:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
CVE-2014-4650 https://nvd.nist.gov/vuln/detail/CVE-2014-4650
CVE-2014-4650;OSVDB-108369 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/webapps/33894.txt
CVE-2014-4650;OSVDB-108369 Exploit https://www.redteam-pentesting.de/advisories/rt-sa-2014-008
RHSA-2015:1064 https://access.redhat.com/errata/RHSA-2015:1064
RHSA-2015:1330 https://access.redhat.com/errata/RHSA-2015:1330
RHSA-2015:2101 https://access.redhat.com/errata/RHSA-2015:2101
USN-2653-1 https://usn.ubuntu.com/2653-1/
Data source Exploit-DB
Date added June 27, 2014
Description Python CGIHTTPServer - Encoded Directory Traversal
Ransomware campaign use Known
Source publication date June 27, 2014
Exploit type webapps
Platform multiple
Source update date June 27, 2014
Source URL https://www.redteam-pentesting.de/advisories/rt-sa-2014-008
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2014-4650
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2014-4650
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2014-4650
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.92333
EPSS Score 0.04364
Published At Jan. 16, 2025, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.