CVE-2023-54397

Katalog CVE

CVSS 7.5 · High EPSS 0,38%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'). Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

17 September 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx
• https://www.vulncheck.com/advisories/tornado-before-6.3.3-http-request-smuggling-via-content-length