CVE-2014-9000

Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user.  NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
VendorProductVersion
mulesoftmule_enterprise_management_console
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/128799
http://seclists.org/fulldisclosure/2014/Oct/107
http://seclists.org/fulldisclosure/2014/Oct/98
http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update
http://packetstormsecurity.com/files/128799
http://seclists.org/fulldisclosure/2014/Oct/107
http://seclists.org/fulldisclosure/2014/Oct/98
http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update