CVE-2018-6333

See a problem?
Source
https://nvd.nist.gov/vuln/detail/CVE-2018-6333
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-6333.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2018-6333
Aliases
Published
2018-12-31T23:29:00Z
Modified
2024-09-03T02:15:15.333759Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.

References

Affected packages

Git / github.com/facebookarchive/nuclide

Affected ranges

Type
GIT
Repo
https://github.com/facebookarchive/nuclide
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed

Affected versions

modules-v0.*

modules-v0.1.10
modules-v0.1.11
modules-v0.1.8
modules-v0.1.9
modules-v0.5.0

v0.*

v0.0.15
v0.0.16
v0.0.17
v0.0.18
v0.0.19
v0.0.20
v0.0.21
v0.0.22
v0.0.23
v0.0.24
v0.0.25
v0.0.26
v0.0.27
v0.0.28
v0.0.29
v0.0.30
v0.0.31
v0.0.32
v0.0.33
v0.0.34
v0.0.35