VULNERABILITY INTELLIGENCE

CVE-2014-3137

CVSS score6.8 MEDIUM
EPSS probability3.13%
CISA KEVNot currently listed
Published2014-10-25
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references