CVE-2023-28370 — tornadoweb / Tornado

Description (CNA)

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

Affected (CNA)

Vendor / product	Versions
tornadoweb / Tornado	affected versions 6.3.1 and earlier

CWE

No CWE identifiers supplied.

References

https://github.com/tornadoweb/tornado/releases/tag/v6.3.2
https://jvn.jp/en/jp/JVN45127776/

ADP enrichment

CVE

No English description supplied.

https://github.com/tornadoweb/tornado/releases/tag/v6.3.2
https://jvn.jp/en/jp/JVN45127776/
https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html

CISA-ADP

No English description supplied.

No references supplied.