Web Cache Poisoning
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | bottle | all versions; before 0.12.19 | 0.12.19 | Patch available | CNA |
| — | bottle (PyPI) | before 0.12.19 | 0.12.19 | Patch available | GHSA-qhx9-7hx7-cp4r |
- bottle Vendor— Affected all versions; before 0.12.19 Fixed in 0.12.19 Patch available CNA
- bottle (PyPI) Vendor— Affected before 0.12.19 Fixed in 0.12.19 Patch available GHSA-qhx9-7hx7-cp4r
Remediation
- Fix · CNA bottle Fixed in 0.12.19
- Fix · GHSA-qhx9-7hx7-cp4r bottle (PyPI) Fixed in 0.12.19 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2020-28473
- 2026-10-03 Alias added: GHSA-qhx9-7hx7-cp4r
References
Advisory 4
Sources
- CVE-2020-28473 · CVE Program
- CVE-2020-28473 · NVD
- FIRST EPSS
- GHSA-qhx9-7hx7-cp4r · GitHub Advisory Database · CC BY 4.0
- CVE-2020-28473 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences