The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2023:3142-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:1045 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2023-28370:
    Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-6669:02 advisory.

    * python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations     (CVE-2023-28370)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-tornado installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-28370 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3144-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:6523 advisory.

    Tornado is a Python web framework and asynchronous networking library that provides an open source version     of scalable, non-blocking web server and tools.

    Security Fix(es):

    * python-tornado: open redirect vulnerability in StaticFileHandler under certain configurations     (CVE-2023-28370)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python-tornado installed on the remote host is prior to 4.2.1-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2132 advisory.

    Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3145-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3143-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-6523 advisory.

    [6.1.0-9]
    - Fix an open redirect in StaticFileHandler       Resolves: CVE-2023-28370

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of python3-tornado installed on the remote host is prior to 5.0.2-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2133 advisory.

    Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3131-1 advisory.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the python- tornado-6.1.0-9.el9 build changelog.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7150-1 advisory.

    It was discovered that Tornado incorrectly handled a certain redirect. A remote attacker could possibly     use this issue to redirect a user to an arbitrary web site and conduct a phishing attack by having the     user access a specially crafted URL. This issue was only addressed in Ubuntu 22.04 LTS, Ubuntu 20.04 LTS,     and Ubuntu 18.04 LTS. Ubuntu 16.04 LTS was previously addressed in USN-6159-1. (CVE-2023-28370)

    It was discovered that Tornado inefficiently handled requests when parsing cookies. An attacker could     possibly use this issue to increase resource utilization leading to a denial of service. (CVE-2024-52804)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker     to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a     specially crafted URL. (CVE-2023-28370)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
179294	SUSE SLES15 Security Update : SUSE Manager Salt Bundle (SUSE-SU-2023:3142-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
239591	TencentOS Server 4: python-tornado (TSSA-2024:1045)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	medium
293606	MiracleLinux 9 : python-tornado-6.1.0-9.el9 (AXSA:2023-6669:02)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	medium
295145	Azure Linux 3.0 Security Update: python-tornado (CVE-2023-28370)	Nessus	Azure Linux Local Security Checks	2026/1/22	2026/1/22	medium
179304	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : SUSE Manager Client Tools (SUSE-SU-2023:3144-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
185117	RHEL 9 : python-tornado (RHSA-2023:6523)	Nessus	Red Hat Local Security Checks	2023/11/7	2025/3/12	medium
178516	Amazon Linux 2 : python-tornado (ALAS-2023-2132)	Nessus	Amazon Linux Local Security Checks	2023/7/20	2024/12/11	medium
179295	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2023:3145-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
179305	SUSE SLES15 Security Update : salt (SUSE-SU-2023:3143-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
185837	Oracle Linux 9 : python-tornado (ELSA-2023-6523)	Nessus	Oracle Linux Local Security Checks	2023/11/16	2025/9/9	medium
178553	Amazon Linux 2 : python3-tornado (ALAS-2023-2133)	Nessus	Amazon Linux Local Security Checks	2023/7/20	2024/12/11	medium
179296	SUSE SLES15 Security Update : salt (SUSE-SU-2023:3131-1)	Nessus	SuSE Local Security Checks	2023/8/3	2023/8/3	medium
191270	CentOS 9 : python-tornado-6.1.0-9.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
212409	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : Tornado vulnerabilities (USN-7150-1)	Nessus	Ubuntu Local Security Checks	2024/12/11	2024/12/11	medium
250426	Linux Distros Unpatched Vulnerability : CVE-2023-28370	Nessus	Misc.	2025/8/18	2025/10/28	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium