Unscored severity · published Oct 25, 2014
CVE-2014-3137
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access…
–
CVSS
3.1%
EPSS
No
On KEV
Description
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BO
Bottle · Bottlepy
0.10.0; 0.10.1; 0.10.2; 0.10.3; 0.10.4; 0.10.5; +20 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3137
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3137
www.debian.org
http://www.debian.org/security/2014/dsa-2948
www.openwall.com
http://www.openwall.com/lists/oss-security/2014/05/01/15
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1093255
github.com
https://github.com/defnull/bottle/issues/616
More from Bottle
9.8
CVE-2022-31799
Bottle before 0.12.20 mishandles errors during early request binding
6.8
CVE-2020-28473
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking
6.5
CVE-2016-9964
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call