Improper input validation in Tornadoweb Tornado

CVE-2012-2374

CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.014 (68.7th percentile) — read the EPSS interpretation.