Description

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

Remediation

References

CVE-2023-28370

Related Vulnerabilities

Ruby on Rails Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-6497)

WordPress Plugin File Manager Arbitrary File Upload (6.8)

Coppermine Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2008-3481)

WordPress Plugin Thrive Architect Security Bypass (2.6.7.3)

WordPress 4.2.x PHP Object Injection (4.2 - 4.2.29)

Severity

Medium

Classification

CVE-2023-28370 CWE-601 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities