Vulnerability Database

318,389

Total vulnerabilities in the database

CVE-2014-3137

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.

  • Published: Oct 25, 2014
  • Updated: Nov 9, 2025
  • CVE: CVE-2014-3137
  • Severity: Medium
  • Exploit:

CVSS v2:

  • Severity: Medium
  • Score: 6.8
  • AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

Software From Fixed in
bottlepy / bottle 0.11.1 0.11.1.x
bottlepy / bottle 0.12.2 0.12.2.x
bottlepy / bottle 0.10.2 0.10.2.x
bottlepy / bottle 0.10.3 0.10.3.x
bottlepy / bottle 0.11.3 0.11.3.x
bottlepy / bottle 0.11.7 0.11.7.x
bottlepy / bottle 0.12.3 0.12.3.x
bottlepy / bottle 0.10.5 0.10.5.x
bottlepy / bottle 0.10.4 0.10.4.x
bottlepy / bottle 0.11.6 0.11.6.x
bottlepy / bottle 0.10.7 0.10.7.x
bottlepy / bottle 0.12.1 0.12.1.x
bottlepy / bottle 0.10.10 0.10.10.x
bottlepy / bottle 0.10.1 0.10.1.x
bottlepy / bottle 0.11.4 0.11.4.x
bottlepy / bottle 0.12.0 0.12.0.x
bottlepy / bottle 0.10.0 0.10.0.x
bottlepy / bottle 0.11.2 0.11.2.x
bottlepy / bottle 0.12.4 0.12.4.x
bottlepy / bottle 0.10.11 0.10.11.x
bottlepy / bottle 0.11.0 0.11.0.x
bottlepy / bottle 0.12.5 0.12.5.x
bottlepy / bottle 0.10.8 0.10.8.x
bottlepy / bottle 0.11.5 0.11.5.x
bottlepy / bottle 0.10.6 0.10.6.x
bottlepy / bottle 0.10.9 0.10.9.x