Directory Traversal

Affecting python2.7 package, versions <2.7.8-1

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

NVD Description

Note: Versions mentioned in the description apply to the upstream python2.7 package. See Remediation section below for Debian:9 relevant versions.

The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.

Remediation

Upgrade Debian:9 python2.7 to version 2.7.8-1 or higher.

References

CVSS Score

9.8
low severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F
CVE
CVE-2014-4650
CWE
CWE-22
Snyk ID
SNYK-DEBIAN9-PYTHON27-306543
Disclosed
20 Feb, 2020
Published
27 Jun, 2018