CVE-2014-3137
Description
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
Risk Information
Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.94
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2014-3137 are fixed in Python-bottle 0.10.12 | Windows |
| Vulnerabilities CVE-2014-3137 are fixed in Python-bottle 0.11.7 | Windows |
| Vulnerabilities CVE-2014-3137 are fixed in Python-bottle 0.12.6 | Windows |
| python-bottle security update(DSA-2948-1) python-bottle_0.12.9-1_all.deb | Linux |
| python-bottle security update(DSA-2948-1) python-bottle_0.12.9-1_all.deb | Linux |
| python-bottle security update(DSA-2948-1) python-bottle_0.10.11-1+deb7u1_all.deb | Linux |
| python-bottle regression update(DSA-3743-2) python-bottle_0.12.9-1_all.deb | Linux |
| Vulnerabilities CVE-2014-3137 are fixed in Python-bottle for linux 0.10.12 | Linux |
| Vulnerabilities CVE-2014-3137 are fixed in Python-bottle for linux 0.11.7 | Linux |
| Vulnerabilities CVE-2014-3137 are fixed in Python-bottle for linux 0.12.6 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234