CVE-2018-6331

CRITICAL

9.8

Description

Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/31/2018

Last Modified5/6/2025

Sourcenvd

Honeypot Sightings0

Affected Products

facebook:buck

Weaknesses (CWE)

CWE-502CWE-502

References

https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf(cve-assign@fb.com)

https://github.com/facebook/buck/commit/8c5500981812564877bd122c0f8fab48d3528ddf(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.