GHSA-hj3f-6gcp-jg8j

Open redirect in Tornado

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-28370

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	tornado	< 6.3.2	6.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-28370 advisory
https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f web
https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2023-75.yaml web
https://github.com/tornadoweb/tornado package
https://github.com/tornadoweb/tornado/releases/tag/v6.3.2 web
https://jvn.jp/en/jp/JVN45127776 web
https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html web