CVE-2014-3137 | BDVDB-2026-65829 Detail

Description#

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12014-10-25Record published in the CVE List.
2. Version 22024-08-06Most recent update recorded in the CVE List.