Vulnerability Details : CVE-2019-3569
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
Vulnerability category: Information leak
Products affected by CVE-2019-3569
- cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:facebook:hhvm:4.4.0:*:*:*:*:*:*:*
Threat overview for CVE-2019-3569
Top countries where our scanners detected CVE-2019-3569
Top open port discovered on systems with this issue
80
IPs affected by CVE-2019-3569 422
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2019-3569!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2019-3569
0.18%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 54 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-3569
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2019-3569
-
The product makes files or directories accessible to unauthorized actors, even though they should not be.Assigned by: cve-assign@fb.com (Secondary)
-
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-3569
-
https://github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74ed
Fix default FastCGI interface · facebook/hhvm@97ef580 · GitHubPatch;Third Party Advisory
-
https://hhvm.com/blog/2019/06/10/hhvm-4.9.0.html
HHVM 4.9.0, and security updates for 3.30, and 4.3-4.7 | HHVMRelease Notes;Vendor Advisory
Jump to