CVE-2020-35579

tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request…

published December 20, 2020

CVSS
—
EPSS
1%
Percentile
66.7
In the wild
Unconfirmed
What it is

tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a request loop and a denial of service may occur.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01151 · 66.7th percentile
Published
2020-12-20T06:31Z
EPSS history
Timeline
  • 20 DEC 06:31Z
    tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request…
    cvelistv5