VULNERABILITY INTELLIGENCE

CVE-2019-3569

CVSS score7.5 HIGH

EPSS probability1.49%

CISA KEVNot currently listed

Published2019-06-26

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.

Weakness classification

CWE-552: Files or Directories Accessible to External Parties
CWE-668: Exposure of Resource to Wrong Sphere

Primary references

cve-assign@fb.com — Patch, Third Party Advisory
cve-assign@fb.com — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory