The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade python2.7 | Jul 30, 2024 | Feb 20, 2020 |
| Oracle_linux | — | Upgrade python27-python-debugUpgrade python-debugUpgrade python27-python-setuptoolsUpgrade python27-python-pipUpgrade python27-python-testUpgrade python-develUpgrade python-libsUpgrade python27-python-toolsUpgrade python-toolsUpgrade python27-scldevelUpgrade tkinterUpgrade python27-runtimeUpgrade python27-python-wheelUpgrade python-testUpgrade python27-python-develUpgrade python27Upgrade python27-pythonUpgrade python27-python-libsUpgrade python27-tkinterUpgrade pythonUpgrade python27-python-simplejson | Oct 16, 2024 | Feb 20, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 20, 2020 |
| Suse | — | Upgrade python3-dbmUpgrade python-doc-pdfUpgrade libpython2_6-1_0Upgrade libpython2_6-1_0-x86Upgrade python3-tkUpgrade python-tkUpgrade python-x86Upgrade python-32bitUpgrade libpython3_6m1_0Upgrade libpython2_7-1_0Upgrade python-xmlUpgrade python36Upgrade python39-cursesUpgrade python-baseUpgrade python3-base-32bitUpgrade python36-baseUpgrade python-base-32bitUpgrade python39-baseUpgrade python3-cursesUpgrade pythonUpgrade python3-toolsUpgrade python3-testsuiteUpgrade python-gdbmUpgrade python39-toolsUpgrade libpython3_6m1_0-32bitUpgrade python-cursesUpgrade python3-32bitUpgrade python3-baseUpgrade python39-tkUpgrade libpython3_4m1_0Upgrade python39-dbmUpgrade libpython2_7-1_0-32bitUpgrade python-docUpgrade libpython2_6-1_0-32bitUpgrade python-idleUpgrade python3-idleUpgrade python3-develUpgrade python-develUpgrade python-base-x86Upgrade python3Upgrade libpython3_9-1_0Upgrade python39Upgrade python39-idleUpgrade libpython3_4m1_0-32bitUpgrade python39-develUpgrade python-demo | Dec 18, 2015 | Jun 25, 2015 |
| Ubuntu | — | Upgrade python3.4-minimalUpgrade python3.4Upgrade python3.2Upgrade python2.7-minimalUpgrade python2.7Upgrade python3.2-minimal | Nov 8, 2024 | Feb 20, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub