CVE-2019-3569: facebook hhvm
Vulnerability summary
CVE-2019-3569 is a high (CVSS 7.5) vulnerability in facebook hhvm. EPSS estimates a 1.49% chance of exploitation in the next 30 days, higher than 73.7% of scored vulnerabilities.
Timeline
- 26-06-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.49%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
0.00 pp
From 1.49% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-552Files or Directories Accessible to External PartiesThe product makes files or directories accessible to unauthorized actors, even though they should not be.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Facebook1 product
- hhvm4.8.1 | 4.7.1 | 4.6.1 | 4.5.1 | 4.4.1 | 4.3.1 | ≥ 4.0.0, < unspecified | 3.30.6 | ≥ unspecified, ≤ 3.30.5 | ≤ 3.30.5 | 4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.1.0 | 4.2.0 | 4.3.0 | 4.4.0 | 4.5.0 | 4.6.0 | 4.7.0 | 4.8.0
Ubuntu1 product
- hhvmAll versions (No fix recorded)
2 vendors · 2 products
References
4 links- github.com/facebook/hhvm/commit/97ef580ec2cca9a54da6f9bd9fdd9a455f6d74edX Refsource MISCPatchThird Party Advisory