Cross-site Scripting (XSS)

2019-01-1508:52:09

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.004 Low

EPSS

Percentile

74.3%

JSON

Python SimpleHTTPServer is vulnerable to cross-site scripting (XSS). The list_directory function in Lib/SimpleHTTPServer.py does not set a charset parameter in the Content-Type HTTP header, allowing an attacker to inject arbitrary Javascript through UTF-7 encoding into Internet Explorer 7 browser via a malicious file name that is uploaded to the server.

CPENameOperatorVersion
pythoneq2.4.3__19.el5
pythoneq2.4.3__24.el5_3.6
pythoneq2.4.3__24.el5
pythoneq2.6.5__3.el6
pythoneq2.6.5__3.el6_0.2
pythoneq2.4.3__27.el5
pythoneq2.4.3__43.el5
pythoneq2.4.3__21.el5
pythoneq2.4.3__27.el5_5.3
pythoneq2.6.6__20.el6

Name	Operator	Version
python	eq	2.4.3__19.el5
python	eq	2.4.3__24.el5_3.6
python	eq	2.4.3__24.el5
python	eq	2.6.5__3.el6
python	eq	2.6.5__3.el6_0.2
python	eq	2.4.3__27.el5
python	eq	2.4.3__43.el5
python	eq	2.4.3__21.el5
python	eq	2.4.3__27.el5_5.3
python	eq	2.6.6__20.el6