The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | debian-upgrade-python2-7 | Jul 30, 2024 | Feb 20, 2020 | |
| Oracle_linux | — | oracle-linux-upgrade-pythonoracle-linux-upgrade-python27oracle-linux-upgrade-python27-pythonoracle-linux-upgrade-python27-python-debugoracle-linux-upgrade-python27-python-develoracle-linux-upgrade-python27-python-libsoracle-linux-upgrade-python27-python-piporacle-linux-upgrade-python27-python-setuptoolsoracle-linux-upgrade-python27-python-simplejsonoracle-linux-upgrade-python27-python-testoracle-linux-upgrade-python27-python-toolsoracle-linux-upgrade-python27-python-wheeloracle-linux-upgrade-python27-runtimeoracle-linux-upgrade-python27-scldeveloracle-linux-upgrade-python27-tkinteroracle-linux-upgrade-python-debugoracle-linux-upgrade-python-develoracle-linux-upgrade-python-libsoracle-linux-upgrade-python-testoracle-linux-upgrade-python-toolsoracle-linux-upgrade-tkinter | Oct 16, 2024 | Feb 20, 2020 |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Feb 20, 2020 |
| Ubuntu | ubuntu-upgrade-python2-7ubuntu-upgrade-python2-7-minimalubuntu-upgrade-python3-2ubuntu-upgrade-python3-2-minimalubuntu-upgrade-python3-4ubuntu-upgrade-python3-4-minimal | Nov 8, 2024 | Feb 20, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub