CVE-2011-1015
(CGIHTTPServer): CGI script source code disclosure
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
4Exploited in Wild
-Decision
Descriptions
The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning of the URI.
El método is_cgi en CGIHTTPServer.py del módulo CGIHTTPServer en Python v2.5,v2.6 y v3.0 permite a atacantes remotos leer el código fuente de los scripts a través de una solicitud HTTP GET que carece de una / ( barra) de caracteres al principio de la URI.
The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / character at the beginning of the URI. A flaw was found in the Python urllib and urllib2 libraries where they would not differentiate between different target URLs when handling automatic redirects. This caused Python applications using these modules to follow any new URL that they understood, including the file:// URL type. This could allow a remote server to force a local Python application to read a local file instead of the remote one, possibly exposing local files that were not meant to be exposed.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2011-02-14 CVE Reserved
- 2011-05-09 CVE Published
- 2024-08-06 CVE Updated
- 2024-08-06 First Exploit
- 2025-04-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (16)
| URL | Tag | Source |
|---|---|---|
| http://secunia.com/advisories/50858 | Third Party Advisory | |
| http://secunia.com/advisories/51024 | Third Party Advisory | |
| http://secunia.com/advisories/51040 | Third Party Advisory | |
| http://securitytracker.com/id?1025489 | Vdb Entry | |
| http://www.securityfocus.com/bid/46541 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| http://bugs.python.org/issue2254 | 2024-08-06 | |
| http://openwall.com/lists/oss-security/2011/02/23/27 | 2024-08-06 | |
| http://openwall.com/lists/oss-security/2011/02/24/10 | 2024-08-06 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=680094 | 2024-08-06 |
| URL | Date | SRC |
|---|---|---|
| http://hg.python.org/cpython/rev/c6c4398293bd | 2019-10-25 | |
| http://svn.python.org/view?view=revision&revision=71303 | 2019-10-25 |
| URL | Date | SRC |
|---|---|---|
| http://www.mandriva.com/security/advisories?name=MDVSA-2011:096 | 2019-10-25 | |
| http://www.ubuntu.com/usn/USN-1596-1 | 2019-10-25 | |
| http://www.ubuntu.com/usn/USN-1613-1 | 2019-10-25 | |
| http://www.ubuntu.com/usn/USN-1613-2 | 2019-10-25 | |
| https://access.redhat.com/security/cve/CVE-2011-1015 | 2011-05-19 |