Every CVESearch/Get API key

CVE-2011-4940

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5...

2.6 LowFix available

CVE-2011-4940 is a low vulnerability (CVSS 2.6) in Python, published June 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.18%, the 88th percentile. Fixed in python2.7 2.7.2-8.

What does this mean?
Severity
2.6 LowCVSS 2.0, NVD
Exploit chance
3.18%EPSS, 88th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2.7.2-8python2.7 +44 more

Description

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Exploit likelihood

3.18%Up 1.2 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-py
Azure Linux:3
through 1.11.0-1None known
python2.7
Debian:11
before 2.7.2-8
2.7.2-8
python2.6
Debian:6.0
From an advisory covering 8 CVEs
before 2.6.6-8+deb6u1, plus listed versions
2.6.6-8
2.6.6-8+deb6u1
python
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-libs
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
tkinter
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-devel
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-test
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-tools
Red Hat:enterprise_linux:6::client
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
Show 35 moreShow less
Affected packages
PackageAffectedFixed
python
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-libs
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-devel
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-test
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-tools
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
tkinter
Red Hat:enterprise_linux:6::computenode
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-devel
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-libs
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
tkinter
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-test
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-tools
Red Hat:enterprise_linux:6::server
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-devel
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-libs
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
tkinter
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-test
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python-tools
Red Hat:enterprise_linux:6::workstation
From an advisory covering 4 CVEs
before 0:2.6.6-29.el6_2.2
0:2.6.6-29.el6_2.2
python
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-libs
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-tools
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
tkinter
Red Hat:enterprise_linux:5::client
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-libs
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
python-tools
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2
tkinter
Red Hat:enterprise_linux:5::server
From an advisory covering 3 CVEs
before 0:2.4.3-46.el5_8.2
0:2.4.3-46.el5_8.2

What each source reports

NVD Score used2.6

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
CVE-2011-4940
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE ListNo score

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
CVE-2011-4940
Updated
2026-11-02
EUVDEUVD-2011-4850No score

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
EUVD-2011-4850
Updated
2026-11-03
GitHub AdvisoriesGHSA-cr6h-6cqx-mw3fNo score

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5...

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
GHSA-cr6h-6cqx-mw3f
Weakness
CWE-79
Updated
2026-11-02
OSVAZL-109590No score

CVE-2011-4940 affecting package python-py 1.11.0-1

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
AZL-109590
Updated
2026-11-02
OSVNo score

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
CVE-2011-4940
Updated
2026-11-02
OSVDEBIAN-CVE-2011-4940No score

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
DEBIAN-CVE-2011-4940
Updated
2026-11-02
OSVPSF-2012-1No score

SimpleHTTPServer UTF-7

The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1, 2.6.x before 2.6.7 rc2, and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.

Record
PSF-2012-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 30 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open