CVE-2014-4650

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.python.org/issue21766Exploit, Patch, Vendor Advisory
http://openwall.com/lists/oss-security/2014/06/26/3Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2014-4650Third Party Advisory
http://bugs.python.org/issue21766Exploit, Patch, Vendor Advisory
http://openwall.com/lists/oss-security/2014/06/26/3Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2014-4650Third Party Advisory

Timeline

Published: Feb 20, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-46519.8It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this fl CVE-2014-46521.9Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementa CVE-2014-46534.6sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, w CVE-2014-46544.6The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check au CVE-2014-46554.9The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly CVE-2014-46564.6Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to CVE-2014-46579.8The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrar CVE-2014-46585.5The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users CVE-2014-46595.5Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opp CVE-2014-46605.5Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow l CVE-2014-46614.3Cross-site scripting (XSS) vulnerability in HP Records Manager before 7.3.5 and 8.x before 8.1 Patch 3 allows remote attackers to inject arb CVE-2014-46636.8TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell