Tornado get_absolute_path validate_absolute_path File Read

The vulnerability of the getabsolutepath and validateabsolutepath methods in the Tornado asynchronous networking library is related to incorrect definition of links before accessing files. Exploiting this vulnerability allows an attacker to read arbitrary files remotely...

Open Redirect

tornado is vulnerable to Open Redirect. The vulnerability exists in the validateabsolutepath function of web.py because it does not properly validate the requests paths that start with double slashes"\", which allows an attacker to redirect users to malicious websites by providing a maliciously...