cbcvebase.
CVE-2014-3137
published 2014-10-25

CVE-2014-3137: Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass…

PriorityP341medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
3.10%
86.3th percentile
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

Affected

30 ranges· showing 25
VendorProductVersion rangeFixed in
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——
bottlepybottle——

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv6.8MEDIUM
vendor_debian6.8MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.