TI-2022-13691 CVE-2022-31799 · GHSA-xhp9-4947-rq78
Bottle before 0.12.20 mishandles errors during early request binding.
Priority MEDIUM 46
Bottle before 0.12.20 mishandles errors during early request binding.
Vulnerabilities
4 records
TI-2020-17286 CVE-2020-28473 · GHSA-qhx9-7hx7-cp4r
Web Cache Poisoning
Priority LOW 34
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking.
TI-2016-08070 CVE-2016-9964 · GHSA-j6f7-hghw-g437
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads…
Priority LOW 32
redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
TI-2014-02506 CVE-2014-3137 · GHSA-873q-wpqr-xfgw
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not…
Priority LOW 36
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type follow…