CVE-2014-9000 Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrar...
MediumCVSS 6.5
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mulesoft mule enterprise management console | All versions | No fix listed |
References
- packetstormsecurity.com exploit
- 20141024 Re: Mulesoft ESB Authenticated Privilege Escalation exploit mailing-list
- 20141022 Mulesoft ESB Authenticated Privilege Escalation exploit mailing-list
- www.mulesoft.org vendor-advisory