TI-2022-13691 CVE-2022-31799 · GHSA-xhp9-4947-rq78
Bottle before 0.12.20 mishandles errors during early request binding.
Priority MEDIUM 46
Bottle before 0.12.20 mishandles errors during early request binding.
Bottlepy
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Bottlepy records in CISA KEVNo Bottlepy vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records in Bottle · all components
TI-2014-02506 CVE-2014-3137 · GHSA-873q-wpqr-xfgw
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not…
Priority LOW 36
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type follow…
TI-2020-17286 CVE-2020-28473 · GHSA-qhx9-7hx7-cp4r
Web Cache Poisoning
Priority LOW 34
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking.
TI-2016-08070 CVE-2016-9964 · GHSA-j6f7-hghw-g437
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads…
Priority LOW 32
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.