CVE-2014-9720
Description
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
Risk Information
Base Score
6.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.904
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2014-9720 are fixed in Python-tornado 3.2.2 | Windows |
| SUSE-SU-2016:1195-1(SUSE Linux Enterprise Desktop 12-SP1 ) python-backports.ssl_match_hostname-3.4.0.2-15.1.noarch.rpm | Linux |
| SUSE-SU-2016:1195-1(SUSE Linux Enterprise Desktop 12-SP1 ) python-tornado-4.2.1-11.1.x86_64.rpm | Linux |
| Vulnerabilities CVE-2014-9720 are fixed in Python-tornado for linux 3.2.2 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234