CVE-2020-35579

2020-12-2007:15:13

Google

osv.dev

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.4%

JSON

tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a request loop and a denial of service may occur.

CPENameOperatorVersion
subconvertereq0.2.3
subconvertereq0.6.4
subconvertereq0.1.0
subconvertereq0.1.1
subconvertereq0.6.3
subconvertereq0.6.1
subconvertereq0.2.0
subconvertereq0.2.6
subconvertereq0.4.1
subconvertereq0.3.1

Name	Operator	Version
subconverter	eq	0.2.3
subconverter	eq	0.6.4
subconverter	eq	0.1.0
subconverter	eq	0.1.1
subconverter	eq	0.6.3
subconverter	eq	0.6.1
subconverter	eq	0.2.0
subconverter	eq	0.2.6
subconverter	eq	0.4.1
subconverter	eq	0.3.1

Rows per page:

1-10 of 321

References

github.com/tindy2013/subconverter/issues/284