PT-2023-9854 · Tornado+8 · Tornado+8
Masashi Yamane
·
Publicado
2023-05-16
·
Atualizado
2025-01-20
·
CVE-2023-28370
CVSS v2.0
6.4
Média
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Tornado versions 6.3.1 and earlier
Description
The issue allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having the user access a specially crafted URL. This is related to the use of open redirect in the Tornado web framework.
Recommendations
For Tornado versions 6.3.1 and earlier, as a temporary workaround, consider restricting access to the affected URL endpoints until a patch is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Open Redirect
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Linuxmint
Red Hat
Red Os
Suse
Tornado
Ubuntu