CVE-2019-13404

Description

The MSI installer for Python through 2.7.16 on Windows defaults to the C:Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendors position is that it is the users responsibility to ensure C:Python27 access control or choose a different directory, because backwards compatibility requires that C:Python27 remain the default for 2.7.x

Risk Information

Base Score

7.8

MODERATE

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.157

Associated Vulnerability

Vulnerability	OS Platform
Files or Directories Accessible to External Parties Vulnerability (CVE-2019-13404)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234