CVE-2011-1015

Published: May 9, 2011Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

The is_cgi method in CGIHTTPServer.py in the CGIHTTPServer module in Python 2.5, 2.6, and 3.0 allows remote attackers to read script source code via an HTTP GET request that lacks a / (slash) character at the beginning of the URI.

Affected (1)

Products: Python: Python

Python

1 product

Python

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Python Python	Version 3.0

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (30)

http://bugs.python.org/issue2254

Source: secalert@redhat.com

ExploitPatch

http://hg.python.org/cpython/rev/c6c4398293bd/

Source: secalert@redhat.com

Patch

http://openwall.com/lists/oss-security/2011/02/23/27

Source: secalert@redhat.com

ExploitPatch

http://openwall.com/lists/oss-security/2011/02/24/10

Source: secalert@redhat.com

ExploitPatch

http://secunia.com/advisories/50858

Source: secalert@redhat.com

http://secunia.com/advisories/51024

Source: secalert@redhat.com

http://secunia.com/advisories/51040

Source: secalert@redhat.com

http://securitytracker.com/id?1025489

Source: secalert@redhat.com

http://svn.python.org/view?view=revision&revision=71303

Source: secalert@redhat.com

Patch

http://www.mandriva.com/security/advisories?name=MDVSA-2011:096

Source: secalert@redhat.com

http://www.securityfocus.com/bid/46541

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1596-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1613-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1613-2

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=680094

Source: secalert@redhat.com

ExploitPatch

http://bugs.python.org/issue2254