tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a request loop and a denial of service may occur.
References
Link | Resource |
---|---|
https://github.com/tindy2013/subconverter/issues/284 | Exploit Third Party Advisory |
https://github.com/tindy2013/subconverter/issues/284 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:27
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/tindy2013/subconverter/issues/284 - Exploit, Third Party Advisory |
Information
Published : 2020-12-20 07:15
Updated : 2024-11-21 05:27
NVD link : CVE-2020-35579
Mitre link : CVE-2020-35579
CVE.ORG link : CVE-2020-35579
JSON object : View
Products Affected
subconverter_project
- subconverter
CWE