What is the CVSS score of CVE-2012-2374?

CVE-2012-2374 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2012-2374?

Yes, a patch is available for CVE-2012-2374. Update the affected software to the latest version immediately.

Tornado CVE-2012-2374

MEDIUM

Improper Input Validation (CWE-20)

2012-05-23 secalert@redhat.com

Code Injection Tornado

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:N/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

May 23, 2012 - 20:55 cve.org

MEDIUM 5.0

DescriptionCVE.org

CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-20. CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input. Affected products include: Tornadoweb Tornado. Version information: before 2.2.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.