Cross-site Scripting Vulnerability in HHVM by Facebook
CVE-2014-9714

Currently unrated

Key Information:

Vendor

Facebook

Status
Hiphop Virtual Machine
Vendor
CVE Published:
13 April 2015

What is CVE-2014-9714?

An XSS vulnerability exists in the WddxPacket::recursiveAddVar function of HHVM prior to version 3.5.0. This flaw permits remote attackers to inject arbitrary web scripts or HTML through specially crafted strings sent to the wddx_serialize_value function, potentially compromising web application security and user data.

References

http://www.securityfocus.com/bid/74061
vdb-entryx_refsource_BID
https://phabricator.wikimedia.org/T85851
x_refsource_CONFIRM
https://github.com/facebook/hhvm/commit/324701c9fd31beb4f...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.