CVEvulnerability

CVE-2019-3569

7.5 HIGH Published 2019-06-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-06-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-552, CWE-668

Description

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.

Affected configurations

• facebook hhvm (<= 3.30.5) • facebook hhvm 4.0.0 • facebook hhvm 4.0.1 • facebook hhvm 4.0.2 • facebook hhvm 4.0.3 • facebook hhvm 4.0.4 • facebook hhvm 4.1.0 • facebook hhvm 4.2.0 • facebook hhvm 4.3.0 • facebook hhvm 4.4.0 • facebook hhvm 4.5.0 • facebook hhvm 4.6.0 • facebook hhvm 4.7.0 • facebook hhvm 4.8.0

Related

Weakness · CWE (2)

  • CWE-552 Files or Directories Accessible to External Parties weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References