Process termination via PID file manipulation (MongoDB Inc. MongoDB Server)
En bref
- Source
- NVD
- EPSS
- EPSS 0.30 % · centile 23 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mongodb
- Statut NVD
- Modified
Description
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.
Faiblesses (CWE)
- CWE-732 — Attribution de permissions incorrecte sur une ressource critique
- CWE-20 — Validation d'entrée incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H | mongodb |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 1.9 | AV:L/AC:M/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2019-12031
- GCVE · GCVE-0-2019-2389
Configurations affectées (CPE NVD)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.22cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.6.0 < 3.6.14cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.11
Produits affectés
| Produit | Versions |
|---|---|
| MongoDB Inc. · MongoDB Server | affected 4.0 < 4.0.11 ; affected 3.6 < 3.6.14 ; affected 3.4 < 3.4.22 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |