Open redirect in tornadoweb Tornado
Priority LOW 30CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01142 66th percentileScored 2026-11-07
Fix Partial tornado (PyPI): 6.3.2Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tornadoweb | Tornado | up to 6.3.1 | — | No fix listed | CNA |
| — | tornado (PyPI) | before 6.3.2 | 6.3.2 | Patch available | GHSA-hj3f-6gcp-jg8j |
- Tornado Vendortornadoweb Affected up to 6.3.1 Fixed in — No fix listed CNA
- tornado (PyPI) Vendor— Affected before 6.3.2 Fixed in 6.3.2 Patch available GHSA-hj3f-6gcp-jg8j
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* | before 6.3.2 | Vulnerable | tornadoweb |
- cpe:2.3:a:tornadoweb:tornado:*:*:*:*:*:*:*:* Versions before 6.3.2 Vulnerable ·tornadoweb
Remediation
- Fix · GHSA-hj3f-6gcp-jg8j tornado (PyPI) Fixed in 6.3.2 Advisory →
Red Hat 1 advisory
- RHSA-2023:6523 Released 2023-11-07 · Red Hat rating Moderatepython-tornado security update
- Red Hat Enterprise Linux AppStream (v. 9) python-tornado-6.1.0-9.el9, python3-tornado-6.1.0-9.el9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6523 |
Not affected: 3 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28370
- 2026-10-03 Alias added: GHSA-hj3f-6gcp-jg8j
References
Other 6
- https://github.com/tornadoweb/tornado/releases/tag/v6.3.2
- https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f
- https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2023-75.yaml
- https://github.com/tornadoweb/tornado
- https://jvn.jp/en/jp/JVN45127776
- https://lists.debian.org/debian-lts-announce/2025/01/msg00000.html
More tornadoweb Tornado vulnerabilities
- TI-2026-24502 Tornado has a DoS due to too many multipart parts CVSS 4.0HIGH 8.7
- TI-2024-35317 Tornado has HTTP cookie parsing DoS vulnerability CVSS 3.1HIGH 7.5
- TI-2025-41422 Tornado is Vulnerable to Quadratic DoS via Crafted Multipart Parameters CVSS 3.1HIGH 7.5
- TI-2025-41421 Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing CVSS 3.1HIGH 7.5
- TI-2025-29817 Tornado vulnerable to excessive logging caused by malformed multipart form data CVSS 3.1HIGH 7.5
- TI-2026-27646 In Tornado before 6.5.5, cookie attribute injection could occur because the domain, path… CVSS 3.1HIGH 7.2
Sources
- CVE-2023-28370 · CVE Program
- CVE-2023-28370 · NVD
- FIRST EPSS
- GHSA-hj3f-6gcp-jg8j · GitHub Advisory Database · CC BY 4.0
- CVE-2023-28370 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences