A vulnerability was found in tornado Package (affected version not known). It has been rated as problematic. Affected by this issue is an unknown code. The manipulation with an unknown input leads to a privilege escalation vulnerability. Using CWE to declare the problem leads to CWE-444. Impacted is confidentiality, integrity, and availability. CVE summarizes:

All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

The weakness was shared 01/18/2021 as SNYK-PYTHON-TORNADO-1017109. The advisory is available at snyk.io. This vulnerability is handled as CVE-2020-28476 since 11/12/2020. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 02/15/2021).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfoedit

Name

• tornado Package

CPE 2.3infoedit

• 🔒

CPE 2.2infoedit

• 🔒

CVSSv3infoedit

CVSSv2infoedit

Exploitinginfoedit

Threat Intelligenceinfoedit

Countermeasuresinfoedit

Timelineinfoedit

Sourcesinfoedit

Entryinfoedit

Comments