The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-2531-1 | python-bottle security update |
 EUVD |
EUVD-2021-0038 | The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. |
 Github GHSA |
GHSA-qhx9-7hx7-cp4r | bottle HTTP Request smuggling |
 Ubuntu USN |
USN-5105-1 | Bottle vulnerability |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: snyk
Published:
Updated: 2024-09-16T20:41:35.337Z
Reserved: 2020-11-12T00:00:00
Link: CVE-2020-28473
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-01-18T12:15:12.707
Modified: 2024-11-21T05:22:51.990
Link: CVE-2020-28473
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses