REDHAT-BUG-2210199: Medium severity Tornado Tornado vulnerability

Q: Which deployments are exposed?

Deployments using Tornado 6.3.1 or earlier are affected. The issue can be triggered remotely and does not require attacker authentication.

Q: What does an attacker need to exploit this issue?

An attacker needs to craft a URL and persuade a user to access it. Successful exploitation redirects the user to an arbitrary website and can support phishing attacks.

Q: What version addresses the vulnerability?

The provided release reference identifies Tornado 6.3.2 as the release following affected versions 6.3.1 and earlier.

Published May 26, 2023

Updated

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

https://jvn.jp/en/jp/JVN45127776/ https://github.com/tornadoweb/tornado/releases/tag/v6.3.2

Affected Software

1 affected component

Tornado Tornado<=6.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Tornado to a version that resolves this vulnerability.
Fixed in 6.3.2

Event History

May 26, 2023

Data Sourced

via Red Hat·04:44 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed?

Deployments using Tornado 6.3.1 or earlier are affected. The issue can be triggered remotely and does not require attacker authentication.

What does an attacker need to exploit this issue?

An attacker needs to craft a URL and persuade a user to access it. Successful exploitation redirects the user to an arbitrary website and can support phishing attacks.

What version addresses the vulnerability?

The provided release reference identifies Tornado 6.3.2 as the release following affected versions 6.3.1 and earlier.

REDHAT-BUG-2210199: Medium severity Tornado Tornado vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What version addresses the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What version addresses the vulnerability?