CVE-2020-28476
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called...
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
What each source reports
OSV Score usedUBUNTU-CVE-2020-28476
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
UBUNTU-CVE-2020-28476- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H - Updated
- 2026-11-06
CVE List No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2020-28476- Updated
- 2026-11-02
EUVDEUVD-2020-20894 No score
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
EUVD-2020-20894- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r544-rgrc-h989 No score
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called...
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
- Record
GHSA-r544-rgrc-h989- Weakness
- CWE-444
- Updated
- 2026-11-02
NVD No score
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage
- Record
CVE-2020-28476- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
python-tornadoUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.2.1-1ubuntu24.2.1-1ubuntu34.2.1-1ubuntu3.14.2.1-1ubuntu3.1+esm14.2.1-1ubuntu3.1+esm24.2.1-1ubuntu3.1+esm34.2.1-1ubuntu3.1+esm44.2.1-1ubuntu3.1+esm5 |
None known |
python-tornadoUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.5.1-2.1~build24.5.2-14.5.3-14.5.3-1ubuntu0.14.5.3-1ubuntu0.2 Show 5 moreShow less4.5.3-1ubuntu0.2+esm14.5.3-1ubuntu0.2+esm24.5.3-1ubuntu0.2+esm34.5.3-1ubuntu0.2+esm44.5.3-1ubuntu0.2+esm5 |
None known |
python-tornadoUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 5.1.1-4ubuntu15.1.1-4ubuntu56.0.3+really5.1.1-26.0.3+really5.1.1-2build16.0.3+really5.1.1-2build2 Show 6 moreShow less6.0.3+really5.1.1-36.0.3+really5.1.1-3ubuntu0.1~esm16.0.3+really5.1.1-3ubuntu0.1~esm36.0.3+really5.1.1-3ubuntu0.1~esm56.0.3+really5.1.1-3ubuntu0.1~esm76.0.3+really5.1.1-3ubuntu0.1~esm8 |
None known |
python-tornado4Ubuntu:20.04:LTS |
All versions, plus listed versions 4.5.3-34.5.3-3build14.5.3-3build2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-28476 has been rejected by its source and should not be treated as a live vulnerability, published January 18, 2021.