Search for vulnerabilities
Vulnerability details: VCID-1ucn-3yzf-73c1
Vulnerability ID VCID-1ucn-3yzf-73c1
Aliases CVE-2024-52804
GHSA-8w49-h785-mj3c
Summary Tornado has an HTTP cookie parsing DoS vulnerability
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-52804.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00162 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00181 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00206 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00228 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00245 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00245 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00275 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
epss 0.00706 https://api.first.org/data/v1/epss?cve=CVE-2024-52804
cvssv3.1 5.3 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 7.5 https://github.com/advisories/GHSA-7pwv-g7hj-39pr
ssvc Track https://github.com/advisories/GHSA-7pwv-g7hj-39pr
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-8w49-h785-mj3c
cvssv3.1 7.5 https://github.com/tornadoweb/tornado
generic_textual HIGH https://github.com/tornadoweb/tornado
cvssv3.1 7.5 https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
generic_textual HIGH https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
ssvc Track https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
cvssv3.1 7.5 https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
cvssv3.1_qr HIGH https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
generic_textual HIGH https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
ssvc Track https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-52804
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-52804
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-52804.json
https://api.first.org/data/v1/epss?cve=CVE-2024-52804
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52804
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/advisories/GHSA-7pwv-g7hj-39pr
https://github.com/tornadoweb/tornado
https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
1088112 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1088112
2328045 https://bugzilla.redhat.com/show_bug.cgi?id=2328045
CVE-2024-52804 https://nvd.nist.gov/vuln/detail/CVE-2024-52804
GHSA-8w49-h785-mj3c https://github.com/advisories/GHSA-8w49-h785-mj3c
GHSA-8w49-h785-mj3c https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
RHSA-2024:10590 https://access.redhat.com/errata/RHSA-2024:10590
RHSA-2024:10836 https://access.redhat.com/errata/RHSA-2024:10836
RHSA-2024:10843 https://access.redhat.com/errata/RHSA-2024:10843
RHSA-2025:2470 https://access.redhat.com/errata/RHSA-2025:2470
RHSA-2025:2471 https://access.redhat.com/errata/RHSA-2025:2471
RHSA-2025:2550 https://access.redhat.com/errata/RHSA-2025:2550
RHSA-2025:2872 https://access.redhat.com/errata/RHSA-2025:2872
RHSA-2025:2955 https://access.redhat.com/errata/RHSA-2025:2955
RHSA-2025:2956 https://access.redhat.com/errata/RHSA-2025:2956
RHSA-2025:3108 https://access.redhat.com/errata/RHSA-2025:3108
RHSA-2025:3109 https://access.redhat.com/errata/RHSA-2025:3109
USN-7150-1 https://usn.ubuntu.com/7150-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-52804.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/advisories/GHSA-7pwv-g7hj-39pr
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-25T17:54:41Z/ Found at https://github.com/advisories/GHSA-7pwv-g7hj-39pr
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tornadoweb/tornado
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-25T17:54:41Z/ Found at https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-25T17:54:41Z/ Found at https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-52804
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.17147
EPSS Score 0.00045
Published At Nov. 23, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-11-23T04:59:01.983747+00:00 GHSA Importer Import https://github.com/advisories/GHSA-8w49-h785-mj3c 35.0.0