CVE-2023-28370: Medium severity tornadoweb tornado vulnerability
Last updated 11 December 2024
Other sources
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tornadoto a version that resolves this vulnerability.Fixed in 6.3.2 - Upgrade
Upgrade
debian/python-tornadoto a version that resolves this vulnerability.Fixed in 6.1.0-1+deb11u1Fixed in 6.2.0-3+deb12u1Fixed in 6.4.2-1 - Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28370?
CVE-2023-28370 has a medium severity rating due to its potential for phishing attacks through open redirection.
How do I fix CVE-2023-28370?
To fix CVE-2023-28370, upgrade to Tornado version 6.3.2 or later.
What versions are affected by CVE-2023-28370?
CVE-2023-28370 affects Tornado versions 6.3.1 and earlier.
Can CVE-2023-28370 be exploited remotely?
Yes, CVE-2023-28370 can be exploited by remote unauthenticated attackers.
What kind of attacks can CVE-2023-28370 facilitate?
CVE-2023-28370 can facilitate phishing attacks by redirecting users to malicious websites.