CVE-2018-6331

CRITICAL

9.8

Descripcion

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado12/31/2018

Ultima modificacion5/6/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

facebook:buck

Debilidades (CWE)

CWE-502CWE-502

Referencias

https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf(cve-assign@fb.com)

https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.