CVE-2014-9000: Medium severity mulesoft mule enterprise management console vulnerability
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9000?
CVE-2014-9000 is considered critical due to its potential for remote code execution and unauthorized access.
How do I fix CVE-2014-9000?
To fix CVE-2014-9000, update to the latest version of the Mule Enterprise Management Console that includes security patches addressing this vulnerability.
Who is affected by CVE-2014-9000?
CVE-2014-9000 affects users of the Mule Enterprise Management Console who have authenticated access.
What types of attacks can CVE-2014-9000 facilitate?
CVE-2014-9000 can facilitate unauthorized administrative access and arbitrary code execution on affected systems.
Is there a workaround for CVE-2014-9000?
While an official fix is recommended, restricting access to handler/securityService.rpc can serve as a temporary workaround for CVE-2014-9000.