CVE-2020-28473
published 2021-01-18CVE-2020-28473: The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate…
PriorityP337medium6.8CVSS 3.1
AVNACHPRNUIRSUCNIHAH
EPSS
1.84%
76.5th percentile
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bottlepy | bottle | < unspecified | unspecified |
| bottlepy | bottle | < 0.12.19 | 0.12.19 |
| bottlepy | bottle | >= 0 < 0.12.19 | 0.12.19 |
| bottlepy | bottle | >= unspecified < 0.12.19 | 0.12.19 |
| debian | debian_linux | — | — |
| debian | python-bottle | < python-bottle 0.12.19-1 (bookworm) | python-bottle 0.12.19-1 (bookworm) |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv6.8MEDIUM
vendor_debian6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
bottle HTTP Request smuggling
ghsa·2021-04-07
CVE-2020-28473 [MEDIUM] CWE-444 bottle HTTP Request smuggling
bottle HTTP Request smuggling
The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
OSV
bottle HTTP Request smuggling
osv·2021-04-07
CVE-2020-28473 [MEDIUM] bottle HTTP Request smuggling
bottle HTTP Request smuggling
The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
OSV
CVE-2020-28473: The package bottle from 0 and before 0
osv·2021-01-18·CVSS 6.8
CVE-2020-28473 [MEDIUM] CVE-2020-28473: The package bottle from 0 and before 0
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Ubuntu
Bottle vulnerability
vendor_ubuntu·2021-10-06
CVE-2020-28473 Bottle vulnerability
Title: Bottle vulnerability
Summary: Bottle could be made to cache malicious requests if it received a
specially crafted input.
It was discovered that Bottle incorrectly handled certain inputs.
An attacker could possibly use this issue to cache malicious requests.
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2020-28473: python-bottle - The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoni...
vendor_debian·2020·CVSS 6.8
CVE-2020-28473 [MEDIUM] CVE-2020-28473: python-bottle - The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoni...
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Scope: local
bookworm: resolved (fixed in 0.12.19-1)
bullseye: resolved (fixed in 0.12.19-1)
forky: resolved (fixed in 0.12.19-1)
sid: resolved (fixed in 0.12.19-1)
trixie: resolved (fixed in 0.12.19-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/bottlepy/bottlehttps://lists.debian.org/debian-lts-announce/2021/01/msg00019.htmlhttps://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108https://github.com/bottlepy/bottlehttps://lists.debian.org/debian-lts-announce/2021/01/msg00019.htmlhttps://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108
2021-01-18
Published