CVE-2014-9720
python-tornado: XSRF cookie allows side-channel attack against TLS (BREACH)
Severity
ModerateRed Hat Product Security
CVSS 2.0
Review impact separately from score.
Published · May 26, 2014
Updated · November 22, 2025
Description
Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 2.0 · 4.3AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-201 · Insertion of Sensitive Information Into Sent Data