CVE-2020-29540 Server-side request forgery in n/a
Attackers can use the Systran Pure Neural Server as a proxy to launch Denial-of-Service attacks against arbitrary internal or external hosts via the Translation API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-29540?
CVE-2020-29540 is a high-severity server-side request forgery vulnerability in n/a, published on 8 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
API calls in the Translation API feature in Systran Pure Neural Server before 9.7.0 allow a threat actor to use the Systran Pure Neural Server as a Denial-of-Service proxy by sending a large amount of translation requests to a destination host on any given TCP port regardless of whether a web service is running on the destination port.
Which versions are affected by CVE-2020-29540?
It affects 1 product.
Products include Systransoft Pure Neural Server.
How do I fix CVE-2020-29540?
No fix has been published for CVE-2020-29540 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-29540 being exploited?
There is no known exploitation of CVE-2020-29540 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-q663-qwpj-9w6q.