CVE-2019-13404

    Dashboard / Vulnerabilities / CVE-2019-13404

    CVE-2019-13404

    Published: 8 Jul 2019Last Modified: 7 Aug 2026

    Summary:

    Details: The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x

    References: https://docs.python.org/2/faq/windows.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v2.7.16
    v2.7.16rc1
    v2.7.15rc1
    v2.7.13rc1
    v2.7.12rc1
    v2.7.11rc1
    v2.7.10rc1
    v2.7.9rc1
    v2.7.8
    v2.7.6rc1
    v2.7.5
    v2.7.4rc1
    v2.7.3rc1
    v2.7.2rc1
    v2.7
    v2.7.1
    v2.7.1rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High