Vulnerability Details : CVE-2014-2209
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.
Products affected by CVE-2014-2209
- cpe:2.3:a:facebook:hiphop_virtual_machine:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-2209
0.26%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 63 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-2209
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2014-2209
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-2209
-
https://github.com/facebook/hhvm/commit/851fff90a9b7461df2393af32239ba217bc25946
Drop supplementary groups when changing to non-root · facebook/hhvm@851fff9 · GitHub
Jump to