SB2022062742 - Path traversal in Python
Published: June 27, 2022 Updated: June 3, 2025
Security Bulletin ID
SB2022062742
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Path traversal (CVE-ID: CVE-2014-4650)
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.
Remediation
Install update from vendor's website.