CVE-2019-3569
published 2019-06-26CVE-2019-3569: HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.49%
70.9th percentile
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hhvm | <= 3.30.5 | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | — | — | |
| hhvm | >= 4.0.0 < unspecified | unspecified | |
| hhvm | unspecified – 3.30.5 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4687-m9rr-f6p3: HHVM, when used with FastCGI, would bind by default to all available interfaces
ghsa_unreviewed·2022-05-24
CVE-2019-3569 [HIGH] CWE-668 GHSA-4687-m9rr-f6p3: HHVM, when used with FastCGI, would bind by default to all available interfaces
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
OSV
CVE-2019-3569: HHVM, when used with FastCGI, would bind by default to all available interfaces
osv·2019-06-26·CVSS 7.5
CVE-2019-3569 [HIGH] CVE-2019-3569: HHVM, when used with FastCGI, would bind by default to all available interfaces
HHVM, when used with FastCGI, would bind by default to all available interfaces. This behavior could allow a malicious individual unintended direct access to the application, which could result in information disclosure. This issue affects versions 4.3.0, 4.4.0, 4.5.0, 4.6.0, 4.7.0, 4.8.0, versions 3.30.5 and below, and all versions in the 4.0, 4.1, and 4.2 series.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-06-26
Published