CVE-2019-2389

MEDIUM

5.3

Beschreibung

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

CVE Details

CVSS v3.1 Bewertung5.3

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

AngriffsvektorLOCAL

KomplexitatHIGH

Erforderliche PrivilegienLOW

BenutzerinteraktionREQUIRED

Veroffentlicht8/30/2019

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

mongodb:mongodb

Schwachen (CWE)

CWE-732CWE-20

Referenzen

https://jira.mongodb.org/browse/SERVER-40563(cna@mongodb.com)

https://jira.mongodb.org/browse/SERVER-40563(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.