medium6.5Public exploit code
CVE-2014-9000
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain admi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Mulesoft ESB Runtime 3.5.1 - Privilege Escalation2014-10-27 · webapps · jsp
Impact
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mulesoft | Mule Enterprise Management Console | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/128799
- http://seclists.org/fulldisclosure/2014/Oct/107
- http://seclists.org/fulldisclosure/2014/Oct/98
- http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update
- http://packetstormsecurity.com/files/128799
- http://seclists.org/fulldisclosure/2014/Oct/107
- http://seclists.org/fulldisclosure/2014/Oct/98
- http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update