What’s Vulnerable › Vulnerabilities

CVE-2014-9720

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-24 · updated 2026-06-17
• Weakness: CWE-203

Description

Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Affected products

• tornadoweb tornado: before 3.2.2 — fixed in 3.2.2

How to fix

Upgrade to a fixed version: tornadoweb tornado 3.2.2. Check the vendor advisory for mitigations.

References

• http://openwall.com/lists/oss-security/2015/05/19/4
• http://www.tornadoweb.org/en/stable/releases/v3.2.2.html
• https://bugzilla.novell.com/show_bug.cgi?id=930362
• https://bugzilla.redhat.com/show_bug.cgi?id=1222816
• https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308
• http://openwall.com/lists/oss-security/2015/05/19/4
• http://www.tornadoweb.org/en/stable/releases/v3.2.2.html
• https://bugzilla.novell.com/show_bug.cgi?id=930362
• https://bugzilla.redhat.com/show_bug.cgi?id=1222816
• https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308

Get alerted when CVE-2014-9720 or the next vulnerability affects your stack