Cross-Site Request Forgery Vulnerability in Tornado Framework by Tornado Web
CVE-2014-9720

6.5MEDIUM

Key Information:

Vendor

Tornadoweb

Status
Tornado
Vendor
CVE Published:
24 January 2020

What is CVE-2014-9720?

The Tornado web framework prior to version 3.2.2 is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability allows attackers to potentially exploit fixed CSRF tokens in responses. By utilizing HTTP compression, a remote attacker may perform a BREACH attack, enabling them to send meticulously crafted requests that can lead to the compromise of sensitive token data.

References

http://www.tornadoweb.org/en/stable/releases/v3.2.2.html
x_refsource_MISC
https://github.com/tornadoweb/tornado/commit/1c36307463b1...
x_refsource_MISC
https://bugzilla.novell.com/show_bug.cgi?id=930362
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.