CVE-2020-1898 - Vulnerability Details

Vendors	Products
Facebook	Hhvm

Link	Providers
https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c
https://hhvm.com/blog/2020/06/30/security-update.html

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "HHVM", "vendor": "Facebook", "versions": [{"lessThan": "unspecified", "status": "unaffected", "version": "4.62.1", "versionType": "custom"}, {"status": "affected", "version": "4.62.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.61.1", "versionType": "custom"}, {"status": "affected", "version": "4.61.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.60.1", "versionType": "custom"}, {"status": "affected", "version": "4.60.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.59.1", "versionType": "custom"}, {"status": "affected", "version": "4.59.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.58.2", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.58.0", "versionType": "custom"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.57.1", "versionType": "custom"}, {"status": "affected", "version": "4.57.0"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.56.1", "versionType": "custom"}, {"lessThan": "unspecified", "status": "affected", "version": "4.33.0", "versionType": "custom"}, {"lessThan": "unspecified", "status": "unaffected", "version": "4.32.3", "versionType": "custom"}, {"lessThan": "4.32.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "dateAssigned": "2020-06-09T00:00:00", "descriptions": [{"lang": "en", "value": "The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "description": "Uncontrolled Recursion (CWE-674)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-03-11T00:55:18", "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "shortName": "facebook"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://hhvm.com/blog/2020/06/30/security-update.html"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve-assign@fb.com", "DATE_ASSIGNED": "2020-06-09", "ID": "CVE-2020-1898", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HHVM", "version": {"version_data": [{"version_affected": "!>=", "version_value": "4.62.1"}, {"version_affected": "=", "version_value": "4.62.0"}, {"version_affected": "!>=", "version_value": "4.61.1"}, {"version_affected": "=", "version_value": "4.61.0"}, {"version_affected": "!>=", "version_value": "4.60.1"}, {"version_affected": "=", "version_value": "4.60.0"}, {"version_affected": "!>=", "version_value": "4.59.1"}, {"version_affected": "=", "version_value": "4.59.0"}, {"version_affected": "!>=", "version_value": "4.58.2"}, {"version_affected": ">=", "version_value": "4.58.0"}, {"version_affected": "!>=", "version_value": "4.57.1"}, {"version_affected": "=", "version_value": "4.57.0"}, {"version_affected": "!>=", "version_value": "4.56.1"}, {"version_affected": ">=", "version_value": "4.33.0"}, {"version_affected": "!>=", "version_value": "4.32.3"}, {"version_affected": "<", "version_value": "4.32.3"}]}}]}, "vendor_name": "Facebook"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Uncontrolled Recursion (CWE-674)"}]}]}, "references": {"reference_data": [{"name": "https://hhvm.com/blog/2020/06/30/security-update.html", "refsource": "CONFIRM", "url": "https://hhvm.com/blog/2020/06/30/security-update.html"}, {"name": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c", "refsource": "MISC", "url": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:53:59.646Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://hhvm.com/blog/2020/06/30/security-update.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c"}]}]}, "cveMetadata": {"assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827", "assignerShortName": "facebook", "cveId": "CVE-2020-1898", "datePublished": "2021-03-11T00:55:18", "dateReserved": "2019-12-02T00:00:00", "dateUpdated": "2024-08-04T06:53:59.646Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : HHVM (string)

vendor : Facebook (string)

versions : [ »

0 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.62.1 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : 4.62.0 (string)

}

2 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.61.1 (string)

versionType : custom (string)

}

3 : { »

status : affected (string)

version : 4.61.0 (string)

}

4 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.60.1 (string)

versionType : custom (string)

}

5 : { »

status : affected (string)

version : 4.60.0 (string)

}

6 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.59.1 (string)

versionType : custom (string)

}

7 : { »

status : affected (string)

version : 4.59.0 (string)

}

8 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.58.2 (string)

versionType : custom (string)

}

9 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.58.0 (string)

versionType : custom (string)

}

10 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.57.1 (string)

versionType : custom (string)

}

11 : { »

status : affected (string)

version : 4.57.0 (string)

}

12 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.56.1 (string)

versionType : custom (string)

}

13 : { »

lessThan : unspecified (string)

status : affected (string)

version : 4.33.0 (string)

versionType : custom (string)

}

14 : { »

lessThan : unspecified (string)

status : unaffected (string)

version : 4.32.3 (string)

versionType : custom (string)

}

15 : { »

lessThan : 4.32.3 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

dateAssigned : 2020-06-09T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-674 (string)

description : Uncontrolled Recursion (CWE-674) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-03-11T00:55:18 (string)

orgId : 4fc57720-52fe-4431-a0fb-3d2c8747b827 (string)

shortName : facebook (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://hhvm.com/blog/2020/06/30/security-update.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

]

url : https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : cve-assign@fb.com (string)

DATE_ASSIGNED : 2020-06-09 (string)

ID : CVE-2020-1898 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : HHVM (string)

version : { »

version_data : [ »

0 : { »

version_affected : !>= (string)

version_value : 4.62.1 (string)

}

1 : { »

version_affected : = (string)

version_value : 4.62.0 (string)

}

2 : { »

version_affected : !>= (string)

version_value : 4.61.1 (string)

}

3 : { »

version_affected : = (string)

version_value : 4.61.0 (string)

}

4 : { »

version_affected : !>= (string)

version_value : 4.60.1 (string)

}

5 : { »

version_affected : = (string)

version_value : 4.60.0 (string)

}

6 : { »

version_affected : !>= (string)

version_value : 4.59.1 (string)

}

7 : { »

version_affected : = (string)

version_value : 4.59.0 (string)

}

8 : { »

version_affected : !>= (string)

version_value : 4.58.2 (string)

}

9 : { »

version_affected : >= (string)

version_value : 4.58.0 (string)

}

10 : { »

version_affected : !>= (string)

version_value : 4.57.1 (string)

}

11 : { »

version_affected : = (string)

version_value : 4.57.0 (string)

}

12 : { »

version_affected : !>= (string)

version_value : 4.56.1 (string)

}

13 : { »

version_affected : >= (string)

version_value : 4.33.0 (string)

}

14 : { »

version_affected : !>= (string)

version_value : 4.32.3 (string)

}

15 : { »

version_affected : < (string)

version_value : 4.32.3 (string)

}

]

}

]

}

vendor_name : Facebook (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Uncontrolled Recursion (CWE-674) (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://hhvm.com/blog/2020/06/30/security-update.html (string)

refsource : CONFIRM (string)

url : https://hhvm.com/blog/2020/06/30/security-update.html (string)

}

1 : { »

name : https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c (string)

refsource : MISC (string)

url : https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T06:53:59.646Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://hhvm.com/blog/2020/06/30/security-update.html (string)

}

1 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 4fc57720-52fe-4431-a0fb-3d2c8747b827 (string)

assignerShortName : facebook (string)

cveId : CVE-2020-1898 (string)

datePublished : 2021-03-11T00:55:18 (string)

dateReserved : 2019-12-02T00:00:00 (string)

dateUpdated : 2024-08-04T06:53:59.646Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "D2372F3F-5757-4097-BA67-61D7597F6D65", "versionEndExcluding": "4.32.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:*", "matchCriteriaId": "E83916FC-54F0-4A1B-99AD-0B81774170EE", "versionEndExcluding": "4.56.1", "versionStartIncluding": "4.33.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.57.0:*:*:*:*:*:*:*", "matchCriteriaId": "4F80C7A6-7FD9-4EAB-8533-F5C8ABF9F258", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.58.0:*:*:*:*:*:*:*", "matchCriteriaId": "2006DF19-68B4-4139-AAAF-7F81B9742DA7", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.58.1:*:*:*:*:*:*:*", "matchCriteriaId": "8A9D0CEF-7EC2-421B-A45D-48D9663DB60B", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.59.0:*:*:*:*:*:*:*", "matchCriteriaId": "169B4C73-75D5-46FD-BADB-384ABFB9A6C9", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.60.0:*:*:*:*:*:*:*", "matchCriteriaId": "A48FC296-D7B6-4B58-A386-9F5F5F6294AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.61.0:*:*:*:*:*:*:*", "matchCriteriaId": "5F702D76-27C2-4798-BF3C-242906E8E697", "vulnerable": true}, {"criteria": "cpe:2.3:a:facebook:hhvm:4.62.0:*:*:*:*:*:*:*", "matchCriteriaId": "AC078675-9A81-4B74-8818-0FFE9AF66296", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0."}, {"lang": "es", "value": "La funci\u00f3n fb_unserialize no impuso un l\u00edmite de profundidad para la deserializaci\u00f3n anidada.&#xa0;Eso significaba que una cadena construida maliciosamente podr\u00eda causar que una deserializaci\u00f3n se repitiera, conllevando a un agotamiento de la pila.&#xa0;Este problema afect\u00f3 a HHVM versiones anteriores a v4.32.3, entre las versiones 4.33.0 y 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0"}], "id": "CVE-2020-1898", "lastModified": "2024-11-21T05:11:34.287", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-11T01:15:14.177", "references": [{"source": "cve-assign@fb.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c"}, {"source": "cve-assign@fb.com", "tags": ["Vendor Advisory"], "url": "https://hhvm.com/blog/2020/06/30/security-update.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://hhvm.com/blog/2020/06/30/security-update.html"}], "sourceIdentifier": "cve-assign@fb.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "cve-assign@fb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-674"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D2372F3F-5757-4097-BA67-61D7597F6D65 (string)

versionEndExcluding : 4.32.3 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:facebook:hhvm:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E83916FC-54F0-4A1B-99AD-0B81774170EE (string)

versionEndExcluding : 4.56.1 (string)

versionStartIncluding : 4.33.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.57.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 4F80C7A6-7FD9-4EAB-8533-F5C8ABF9F258 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.58.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 2006DF19-68B4-4139-AAAF-7F81B9742DA7 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.58.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 8A9D0CEF-7EC2-421B-A45D-48D9663DB60B (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.59.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 169B4C73-75D5-46FD-BADB-384ABFB9A6C9 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.60.0:*:*:*:*:*:*:* (string)

matchCriteriaId : A48FC296-D7B6-4B58-A386-9F5F5F6294AF (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.61.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 5F702D76-27C2-4798-BF3C-242906E8E697 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:facebook:hhvm:4.62.0:*:*:*:*:*:*:* (string)

matchCriteriaId : AC078675-9A81-4B74-8818-0FFE9AF66296 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : The fb_unserialize function did not impose a depth limit for nested deserialization. That meant a maliciously constructed string could cause deserialization to recurse, leading to stack exhaustion. This issue affected HHVM prior to v4.32.3, between versions 4.33.0 and 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0. (string)

}

1 : { »

lang : es (string)

value : La función fb_unserialize no impuso un límite de profundidad para la deserialización anidada. Eso significaba que una cadena construida maliciosamente podría causar que una deserialización se repitiera, conllevando a un agotamiento de la pila. Este problema afectó a HHVM versiones anteriores a v4.32.3, entre las versiones 4.33.0 y 4.56.0, 4.57.0, 4.58.0, 4.58.1, 4.59.0, 4.60.0, 4.61.0, 4.62.0 (string)

}

]

id : CVE-2020-1898 (string)

lastModified : 2024-11-21T05:11:34.287 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 5 (number)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:N/C:N/I:N/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-03-11T01:15:14.177 (string)

references : [ »

0 : { »

source : cve-assign@fb.com (string)

tags : [ »

0 : Patch (string)

1 : Third Party Advisory (string)

]

url : https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c (string)

}

1 : { »

source : cve-assign@fb.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://hhvm.com/blog/2020/06/30/security-update.html (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Third Party Advisory (string)

]

url : https://github.com/facebook/hhvm/commit/1746dfb11fc0048366f34669e74318b8278a684c (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://hhvm.com/blog/2020/06/30/security-update.html (string)

}

]

sourceIdentifier : cve-assign@fb.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-674 (string)

}

]

source : cve-assign@fb.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-674 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object