fkie_cve-2011-4940
Vulnerability from fkie_nvd
Published
2012-06-27 10:18
Modified
2024-11-21 01:33
Severity ?
Summary
The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.
References
secalert@redhat.comhttp://bugs.python.org/issue11442
secalert@redhat.comhttp://jvn.jp/en/jp/JVN51176027/index.html
secalert@redhat.comhttp://jvndb.jvn.jp/jvndb/JVNDB-2012-000063
secalert@redhat.comhttp://secunia.com/advisories/50858
secalert@redhat.comhttp://secunia.com/advisories/51024
secalert@redhat.comhttp://secunia.com/advisories/51040
secalert@redhat.comhttp://www.securityfocus.com/bid/54083
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-1592-1
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-1596-1
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-1613-1
secalert@redhat.comhttp://www.ubuntu.com/usn/USN-1613-2
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=803500
af854a3a-2127-422b-91ae-364da2661108http://bugs.python.org/issue11442
af854a3a-2127-422b-91ae-364da2661108http://jvn.jp/en/jp/JVN51176027/index.html
af854a3a-2127-422b-91ae-364da2661108http://jvndb.jvn.jp/jvndb/JVNDB-2012-000063
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/50858
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51024
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/51040
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/54083
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-1592-1
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-1596-1
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-1613-1
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/USN-1613-2
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=803500
Impacted products
Vendor Product Version
python python *
python python 0.9.0
python python 0.9.1
python python 1.2
python python 1.3
python python 1.5.2
python python 1.6
python python 1.6.1
python python 2.0.1
python python 2.1.1
python python 2.1.2
python python 2.1.3
python python 2.2.1
python python 2.2.2
python python 2.2.3
python python 2.3.1
python python 2.3.2
python python 2.3.3
python python 2.3.4
python python 2.3.5
python python 2.3.7
python python 2.4.1
python python 2.4.2
python python 2.4.3
python python 2.4.4
python python 2.4.6
python python 2.5.1
python python 2.5.2
python python 2.5.3
python python 2.5.4
python python 2.6.1
python python 2.6.2
python python 2.6.3
python python 2.6.4
python python 2.6.5
python python 2.6.6
python python 2.7.1
python python 2.7.1
python python 2.7.2


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "696C2497-C870-4AF2-B9A1-5994E5F40F99",
              "versionEndIncluding": "2.5.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:0.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC4F49A3-B5D0-447C-859E-C415280040C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:0.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A65A3088-D28E-4781-8374-FC7B9A97CAFD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "39902E97-2937-48F5-8FDE-5C8F030FA8DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "27E9A887-ACB1-4602-8E5D-D82361E93E3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:1.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B0DB6484-06C5-4E74-B0FA-198523C60C04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "0CA90DC8-6C72-4925-99B9-C7341ED94952",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:1.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FAA8C532-04F2-4F61-86AD-5289C9E605EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AEB6ED07-C176-496D-B9CA-F24933D71999",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1A223BB3-DD5A-48C9-9C82-5D1C4F122828",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C14973EE-5A2E-4935-8D29-594761502D72",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "3E502388-0A87-4503-8EC9-8A43E8BF43E9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A3CD168A-2180-44C8-8784-3B32589904BB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB30EAAD-5CF0-41DD-909B-C6AD94D88ABB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "569FAD3A-17DF-424A-AF93-B0720D48D6B6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BD8ED56-5568-4461-B94A-0B5C1EF8C01A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "396FFF60-8F61-43E5-BF0C-A0C319714247",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "75872F94-A537-4E57-8325-3426DB5D6C75",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "6A038A64-E659-47BB-B2C6-8FD151684CBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "A82F7C03-C9D3-4B83-AF74-30981EC25431",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "02839080-EFB1-4F63-9D4E-45E26D82ECF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "00C353D0-C579-4C0B-AD7D-9E56353F2BF5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "7FB87E45-DBC2-4D0F-B4E9-38585D2F92A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "976E5CD0-3A1E-43E6-9C34-B8F1EE1AB863",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "179EDC23-2328-4BB6-98D5-7C1A975A0C46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "87B6E723-EC9D-44EF-9DB8-8A229E0ABBB5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "12D3CD4F-0C58-46F4-939D-FDF19BC98729",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6D13FC75-3979-40A8-A1FE-EF86EB15C8A7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "78AE8C3C-53A1-408A-BA23-1EBA1E6A0E4C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA59C66F-E469-42C1-9745-330E35AE5A26",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:python:2.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "244740D0-CACA-4607-964C-F0F46153653D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA3487C5-05AD-4553-B123-45F0A51BBA3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "486AB201-5BE7-4947-B18B-DA8F86E5D626",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E852D2C6-D744-4311-97B3-CAEF073D6585",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.6.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "845FBD14-4175-49F1-B762-4F550CEF5B0D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "84E7646B-BC7C-4ED6-925B-268291F31610",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:python:python:2.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "8CE2063E-5B74-4731-885F-80D2D7B15604",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.7.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "FC647F82-9679-4B26-AFF1-1B43B0AF18B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:python:python:2.7.2:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "046BCC55-F166-4C31-AB2B-815A0DFA2BEE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding."
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n list_directory en lib/SimpleHTTPServer.py en SimpleHTTPServer en Python anterior a v2.5.6c1, v2.6.x anterior a v2.6.7 RC2, y v2.7.x anterior a v2.7.2 no pone un par\u00e1metro charset en la cabecera Content-Type de HTTP, lo que hace m\u00e1s f\u00e1cil para los atacantes remotos realizar ataques XSS contra Internet Explorer 7 a trav\u00e9s de codificaci\u00f3n UTF-7."
    }
  ],
  "id": "CVE-2011-4940",
  "lastModified": "2024-11-21T01:33:20.067",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 2.6,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-06-27T10:18:36.433",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://bugs.python.org/issue11442"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://jvn.jp/en/jp/JVN51176027/index.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000063"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/50858"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/51024"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://secunia.com/advisories/51040"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/54083"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-1592-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-1596-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-1613-1"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.ubuntu.com/usn/USN-1613-2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=803500"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://bugs.python.org/issue11442"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvn.jp/en/jp/JVN51176027/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000063"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/50858"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/51024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/51040"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/54083"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1592-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1596-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1613-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/USN-1613-2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=803500"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.