CVE-2014-2209 Privilege escalation in n/a
Remote attackers can bypass access restrictions and escalate privileges by leveraging retained supplemental group memberships in HHVM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2014-2209?
CVE-2014-2209 is a medium-severity vulnerability in n/a, published on 28 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.
Weakness: CWE-264
Which versions are affected by CVE-2014-2209?
It affects 1 product.
Products include Facebook Hiphop Virtual Machine.
How do I fix CVE-2014-2209?
No fix has been published for CVE-2014-2209 yet. Limit exposure of the affected software until one is available.
Is CVE-2014-2209 being exploited?
There is no known exploitation of CVE-2014-2209 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-pfmj-wcxj-rwm5.