6.1

CVE-2023-28370: tornadoweb tornado Open Redirect

CVSS: 6.1v3.1MediumModified
AliasesMGASA-2023-0211SUSE-EL-9-CLIENT-TOOLS-2023-3137SUSE-SU-2023:2770-1
Published 25-05-2023Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2023-28370 is a medium (CVSS 6.1) Open Redirect vulnerability in tornadoweb tornado. EPSS estimates a 1.14% chance of exploitation in the next 30 days, higher than 66.2% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.1/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.14%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
DLA-4007-1USN-7150-1

Timeline

  1. 25-05-2023
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

1.14%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

0.00 pp

From 1.14% on 20-09-2026

20-09-202620-10-2026
EPSS score
1.14%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse74 products
  • kiwi-desc-saltboot&distro=SUSE Manager Client Tools 12< 0.1.1687520761.cefb248-1.35.2
  • prometheus-blackbox_exporter&distro=SUSE Manager Client Tools 12< 0.24.0-1.20.3
  • prometheus-blackbox_exporter&distro=SUSE Manager Client Tools 15< 0.24.0-150000.1.20.2
  • prometheus-blackbox_exporter&distro=SUSE Manager Client Tools for SLE Micro 5< 0.24.0-150000.1.20.2
  • prometheus-blackbox_exporter&distro=SUSE Manager Proxy Module 4.2< 0.24.0-150000.1.20.2
Opensuse15 products
  • prometheus-blackbox_exporter&distro=openSUSE Leap 15.4< 0.24.0-150000.1.20.2
  • prometheus-blackbox_exporter&distro=openSUSE Leap 15.5< 0.24.0-150000.1.20.2
  • python-tornado6&distro=openSUSE Tumbleweed< 6.5.7-2.1
  • python-tornado&distro=openSUSE Leap 15.4< 4.5.3-150000.3.6.1
  • python-tornado&distro=openSUSE Leap 15.5< 4.5.3-150000.3.6.1
Redhat4 products
  • python-tornado< 0:6.1.0-9.el9
  • python-tornado-debugsource< 0:6.1.0-9.el9
  • python3-tornado< 0:6.1.0-9.el9
  • python3-tornado-debuginfo< 0:6.1.0-9.el9
Ubuntu2 products
  • python-tornado< 4.5.3-1ubuntu0.2+esm1 | < 6.0.3+really5.1.1-3ubuntu0.1~esm1 | < 6.1.0-3ubuntu0.1~esm1 | < 4.2.1-1ubuntu3.1+esm1
  • saltAll versions (No fix recorded)
Debian1 product
  • python-tornado< 6.2.0-3+deb12u1 | < 6.3.2-1
Mageia1 product
  • python-tornado< 6.1-1.1.mga8
PyPI1 product
  • tornado< 6.3.2
Tornadoweb1 product
  • tornadoversions 6.3.1 and earlier | < 6.3.2

8 vendors · 99 products

References

45 links
Show all 45 references