Threats tagged 'ghsa-cfc4-jgx9-vvjh'

Tornado versions prior to 6.6 do not validate the max_age argument in the RequestHandler.set_cookie method and related cookie-setting methods. This flaw allows an attacker to inject additional Set-Cookie attributes by supplying malicious input as max_age. Such attributes can include Domain, Path, or Secure, potentially expanding the cookie's scope to parent paths or other subdomains. The vulnerability has a medium severity rating with a CVSS score of 4.2.