Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM9755FFDBCA34B464FDE49F9F8DE37D058E26B1C692A95A71CF0C207DFD08BD1C
HistoryJun 12, 2023 - 8:15 a.m.

Security Bulletin: Vulnerability in bottle-0.12.16 affects IBM Integrated Analytics System [CVE-2020-28473]

2023-06-1208:15:14
www.ibm.com
9
ibm integrated analytics system
bottle-0.12.16
cve-2020-28473
http response splitting
upgrade

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS

0.004

Percentile

74.9%

JSON

Summary

The bottle-0.12.16 package is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable vulnerability[CVE-2020-28473].

Vulnerability Details

CVEID:CVE-2020-28473
**DESCRIPTION:**Bottle is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability to inject arbitrary HTTP headers and cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning or cross-site scripting, and possibly obtain sensitive information.
CVSS Base score: 6.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195066 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Integrated Analytics System 1.0.0-1.0.27.3

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading to latest version.

Product VRMF Remediation/First Fix
IBM Integrated Analytics System 1.0.28.0 Link to Fix Central

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmsmart_analytics_system_7710Range1.0.0≥
OR
ibmsmart_analytics_system_7710Range≤1.0.27.3
VendorProductVersionCPE
ibmsmart_analytics_system_7710*cpe:2.3:a:ibm:smart_analytics_system_7710:*:*:*:*:*:*:*:*

Related

suse 1
nessus 3
openvas 5
veracode 1
osv 5
ubuntu 1
prion 1
ubuntucve 1
debian 1
nvd 1
cve 1
debiancve 1
redhatcve 1
mageia 1
ibm 1
github 1
cvelist 1
suse
suse
Security update for python-bottle (important)
2021-02-16 00:00:00
nessus
nessus
Debian DLA-2531-1 : python-bottle security update
2021-01-25 00:00:00
Ubuntu 18.04 LTS / 20.04 LTS : Bottle vulnerability (USN-5105-1)
2021-10-07 00:00:00
openSUSE Security Update : python-bottle (openSUSE-2021-302)
2021-02-22 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-5105-1)
2021-10-08 00:00:00
Debian: Security Advisory (DLA-2531-1)
2021-01-25 00:00:00
openSUSE: Security Advisory for python-bottle (openSUSE-SU-2021:0302-1)
2021-04-16 00:00:00
veracode
veracode
HTTP Request Smuggling
2021-01-19 01:45:09
osv
osv
python-bottle - security update
2021-01-24 00:00:00
CVE-2020-28473
2021-01-18 12:15:12
python-bottle vulnerability
2021-10-06 16:54:36
ubuntu
ubuntu
Bottle vulnerability
2021-10-06 00:00:00
prion
prion
Design/Logic Flaw
2021-01-18 12:15:00
ubuntucve
ubuntucve
CVE-2020-28473
2021-01-18 00:00:00
debian
debian
[SECURITY] [DLA 2531-1] python-bottle security update
2021-01-24 19:19:40
nvd
nvd
CVE-2020-28473
2021-01-18 12:15:12
cve
cve
CVE-2020-28473
2021-01-18 12:15:12
debiancve
debiancve
CVE-2020-28473
2021-01-18 12:15:12
redhatcve
redhatcve
CVE-2020-28473
2021-02-09 12:50:09
mageia
mageia
Updated python-bottle packages fix security vulnerability
2021-04-02 23:25:05
ibm
ibm
Security Bulletin: Vulnerability in bottle-0.12.16 affects IBM Cloud Pak for Data System 1.0(CPDS 1.0) [CVE-2020-28473]
2023-07-18 05:34:29
github
github
bottle HTTP Request smuggling
2021-04-07 21:05:21
cvelist
cvelist
CVE-2020-28473 Web Cache Poisoning
2021-01-18 11:15:14

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

EPSS

0.004

Percentile

74.9%

JSON
Related for 9755FFDBCA34B464FDE49F9F8DE37D058E26B1C692A95A71CF0C207DFD08BD1C
suse1nessus3openvas5veracode1osv5ubuntu1prion1ubuntucve1debian1nvd1cve1debiancve1redhatcve1mageia1ibm1github1cvelist1