Vulnerability Details : CVE-2020-35579

tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a request loop and a denial of service may occur.
Published 2020-12-20 07:15:13
Updated 2020-12-22 19:49:10
Source MITRE
View at NVD,   CVE.org
Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2020-35579

EPSS FAQ
0.12%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 44 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-35579

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.0
 MEDIUM AV:N/AC:L/Au:N/C:N/I:N/A:P
10.0
2.9
 NIST
7.5
 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
3.9
3.6
 NIST

References for CVE-2020-35579

  • https://github.com/tindy2013/subconverter/issues/284
    [vulnerability] Loop Request检测存在问题，可实现拒绝服务攻击 / Loop Request detection is too fragile and can realize denial of service attacks. · Issue #284 · tindy2013/subconverter · GitHub
    Exploit;Third Party Advisory

Products affected by CVE-2020-35579

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close