CVE-2020-35579

    Dashboard / Vulnerabilities / CVE-2020-35579

    CVE-2020-35579

    Published: 20 Dec 2020Last Modified: 8 Jul 2026

    Summary:

    Details: tindy2013 subconverter 0.6.4 has a /sub?target=%TARGET%&url=%URL%&config=%CONFIG% API endpoint that accepts an arbitrary %URL% value and launches a GET request for it, but does not consider that the external request target may indirectly redirect back to this original /sub endpoint. Thus, a request loop and a denial of service may occur.

    References: https://github.com/tindy2013/subconverter/issues/284

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ab4d7543cec46cd9e45680f3b43d82de16f38a3d
    Fixed -None

    Affected versions

    0.6.4

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-35579 | CVE-DB