CVE-2020-23622

Published: Aug 15, 2022Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header

Affected (1)

Products: Cling Project: Cling

Cling Project

1 product

Cling

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cling Project Cling	From 2.0.0 to 2.1.2

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (4)

https://github.com/4thline/cling/issues/253

Source: cve@mitre.org

ExploitIssue TrackingPatchThird Party Advisory

https://zh-cn.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of?tns_redirect=true

Source: cve@mitre.org

Not Applicable

https://github.com/4thline/cling/issues/253

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingPatchThird Party Advisory

https://zh-cn.tenable.com/blog/cve-2020-12695-callstranger-vulnerability-in-universal-plug-and-play-upnp-puts-billions-of?tns_redirect=true

Source: af854a3a-2127-422b-91ae-364da2661108

Not Applicable

Timeline

No history available yet.