Yüksek CVSS 7.4

CVE-2021-28861: Python: açık yönlendirme

Yayın: 23 Ağustos 2022 04:15 · Güncelleme: 6 Kasım 2026 09:48

Açıklama (NVD)

Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html documentation page states "Warning: http.server is not recommended for production. It only implements basic security checks."

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
EPSS: %2,68 (yüzdelik 86)
CWE: CWE-601
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	3.0.0	—	3.7.14
python-python	3.8.0	—	3.8.14
python-python	3.9.0	—	3.9.14
python-python	3.10.0	—	3.10.6
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
python-python	3.11.0	3.11.0	—
fedoraproject-fedora	35	35	—
fedoraproject-fedora	36	36	—
fedoraproject-fedora	37	37	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları