CVE-2014-4650

51

FAUCET Score

CVE-2014-4650 describes a critical directory traversal vulnerability in the CGIHTTPServer module of Python versions 2.7.5 and 3.3.4, also affecting Red Hat Enterprise Linux and Software Collections. Attackers can exploit this by using URL-encoded path separators to read script source code, perform directory traversal, and execute unintended code. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with high impact on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog or showing active community discussion, an ExploitDB entry exists, indicating public exploit code availability.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.7.0, < 2.7.8CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		>= 3.2.0, < 3.2.6CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		>= 3.3.0, < 3.3.6CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		>= 3.4.0, < 3.4.2CPE matchmatch criteria	cpe:2.3:a:python:python::::::::
		Range not provided by sourceCPE matchmatch criteria	cpe:2.3:a:redhat:software_collections:-:::::::*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

24.70%

Probability of exploitation in next 30 days

EPSS Percentile

97.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

ExploitDB: EDB-33894 · Jun 27, 2014

This CVE's current EPSS score of 0.2470 is in the 94th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: python-0:2.6.6-64.el6

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: python-0:2.7.5-34.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-0:1.1-17.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-0:2.7.8-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-pip-0:1.5.6-5.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-setuptools-0:0.9.8-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-simplejson-0:3.2.0-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: python27-python-wheel-0:0.24.0-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: python27-0:1.1-17.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: python27-python-0:2.7.8-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: python27-python-pip-0:1.5.6-5.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: python27-python-setuptools-0:0.9.8-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: python27-python-simplejson-0:3.2.0-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.5 EUSFixed in: python27-python-wheel-0:0.24.0-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: python27-0:1.1-17.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: python27-python-0:2.7.8-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: python27-python-pip-0:1.5.6-5.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: python27-python-setuptools-0:0.9.8-3.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: python27-python-simplejson-0:3.2.0-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: python27-python-wheel-0:0.24.0-2.el6

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-0:1.1-20.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-0:2.7.8-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-pip-0:1.5.6-5.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-setuptools-0:0.9.8-5.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-simplejson-0:3.2.0-3.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: python27-python-wheel-0:0.24.0-2.el7

redhatno patchvia redhat_api

Product: Red Hat Software CollectionsFixed in: python27-python

redhatend of lifevia redhat_api

Product: Red Hat Enterprise Linux 5Fixed in: python

redhatend of lifevia redhat_api

Product: Red Hat Software CollectionsFixed in: python33-python

Vendor Advisories (1)

redhatCVE-2014-4650Moderate

python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs

References

bugs.python.org / issue21766

ExploitPatchVendor Advisory

openwall.com / lists/oss-security/2014/06/26/3

Mailing ListThird Party Advisory

access.redhat.com / security/cve/cve-2014-4650

Third Party Advisory