{"action":"Upgrade bottle to 0.12.19 or later.","affected":[{"fixed":"0.12.19","introduced":"0"}],"component":"bottle","cve_ids":["CVE-2020-28473"],"ecosystem":"PyPI","epss":0.01786,"exploited":false,"fixed_versions":["0.12.19"],"ghsa_id":"GHSA-qhx9-7hx7-cp4r","id":"tcs_01M5KGB6B0KWBF7SC88EEP4GGZ","modified_at":"2023-11-08T04:03:27.869657Z","published_at":"2021-01-18T12:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-129","https://snyk.io/vuln/SNYK-PYTHON-BOTTLE-1017108","https://github.com/bottlepy/bottle","https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/","https://lists.debian.org/debian-lts-announce/2021/01/msg00019.html","https://github.com/advisories/GHSA-qhx9-7hx7-cp4r"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-129","url":"https://osv.dev/vulnerability/PYSEC-2021-129"}],"summary":"The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), t"}