CVE-2016-9964 | BDVDB-2026-79823 Detail

Description#

redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12016-12-16Record published in the CVE List.
2. Version 22024-08-06Most recent update recorded in the CVE List.