Source: python · Limited verification•Last verified: •Collection Degraded
CVE-2019-9948Unknown / EvaluatingCRITICAL (raw)CVSS 9.1CWE-22
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
Published: 23 Mar 2019•Last updated: 14 Oct 2026, 12:46 PM IST•Source identifier: cve@mitre.org
Dossier completeness: source-provided sections 2 / 3 · rule guidance available. Missing source facts count as incomplete.
CISA KEV catalog
Unknown
KEV status was not determined.
CVSS score
9.1CRITICAL (raw)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Metric sourcenvd@nist.gov
EPSS probability
11.8%0.118
Percentile96th
Weakness type
CWE-22
No further CWE recorded
Remediation
Patch status unknown
No fixed version or KB recorded
Why It Matters
Analysis dossierWhy It Matters
urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.
SOC priority
High Severity / Review
Actively exploited
Unknown
Publicly disclosed
Unknown
Risk basis: SOC ecosystem technology relevance; CRITICAL severity; Critical CVSS without confirmed KEV exploitation
Affected Products & Remediation
11 source-backed productsAffected products and versions (source)
- python python · >= 2.0 < 2.7.17; >= 3.5.0 < 3.5.8; >= 3.6.0 < 3.6.9; >= 3.7.0 < 3.7.4 · NVD CPE · Source
- opensuse leap · 15.0; 42.3 · NVD CPE · Source
- debian debian linux · 8.0; 9.0 · NVD CPE · Source
- fedoraproject fedora · 29; 30 · NVD CPE · Source
- canonical ubuntu linux · 12.04; 14.04; 16.04; 18.04; 19.04 · NVD CPE · Source
- redhat enterprise linux desktop · 7.0; 8.0 · NVD CPE · Source
- redhat enterprise linux eus · 8.1; 8.2; 8.4; 8.6 · NVD CPE · Source
- redhat enterprise linux server · 7.0; 8.0; eus 8.4 · NVD CPE · Source
- redhat enterprise linux server eus · 8.4 · NVD CPE · Source
- redhat enterprise linux tus · 8.2; 8.4; 8.6 · NVD CPE · Source
- redhat enterprise linux workstation · 7.0; 8.0 · NVD CPE · Source
Recorded patch / KBNot provided by source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched path-traversal (CWE-22); network-unauthenticated (CVSS AV:N, CVSS PR:N, CVSS UI:N)
Exposure
- Locate affected deployments and the path-handling endpoint named by the advisory.Telemetry: Application access logs · The affected path must come from the source, not the CWE alone. · Rule path-traversal
- Identify devices reporting this CVE and note which expose the affected service to untrusted networks.Telemetry: DeviceTvmSoftwareVulnerabilities · A network-reachable, no-privilege vector makes internet-facing instances the first exposure question. · Rule network-unauthenticated
Exploitation evidence
- Review requests to that endpoint for traversal encodings and unusual file responses.Telemetry: Application access logs · Such patterns are a hypothesis to validate against normal traffic. · Rule path-traversal
Show more (2)
Exploitation evidence
- Review inbound connections to the affected service from unexpected sources since the advisory date.Telemetry: DeviceNetworkEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule network-unauthenticated
Response
- Verify the source-stated fix and retest the affected path.Telemetry: Application change records · The exact remediation depends on the source advisory. · Rule path-traversal
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- cve@mitre.org
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:*, cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*, cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*, cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*, cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*, cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*, cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*, cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Evidence & Provenance
Linked by the query's stored exact CVE association. Review required tables and validation status before use.
Detection Hunting Query
Target: DeviceTvmSoftwareVulnerabilities•Defender XDR
Detect endpoints exposed to CVE-2019-9948
Purpose: Exposure assessment (Category: Exposure Check)Why linked: Query metadata names CVE-2019-9948
DeviceTvmSoftwareVulnerabilities| where CveId == "CVE-2019-9948"| project DeviceId, DeviceName, OSPlatform, OSVersion, SoftwareVendor, SoftwareName, SoftwareVersion, CveId, VulnerabilitySeverityLevel, RecommendedSecurityUpdate, RecommendedSecurityUpdateId| sort by VulnerabilitySeverityLevel descSchema Checked · Not runtime validatedSource: SecOps Signal deterministic template · Limited verificationStatic screening: Passed structure and schema checks; tenant execution is not verified.
Correlated briefings
— No published briefing references this CVE
SecOps Signal surfaces public advisory facts only. A missing value means the source has not published it, not that your environment is unaffected. No tenant inventory is connected.