Process termination via PID file manipulation (MongoDB Inc. MongoDB Server)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.30 % · percentile 23 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mongodb
- NVD status
- Modified
Description
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.
Weaknesses (CWE)
- CWE-732 — Incorrect Permission Assignment for Critical Resource
- CWE-20 — Improper Input Validation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H | mongodb |
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H | NVD · cna@mongodb.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.2 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 1.9 | AV:L/AC:M/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2019-12031
- GCVE · GCVE-0-2019-2389
Affected configurations (NVD CPE)
cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.4.0 < 3.4.22cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 3.6.0 < 3.6.14cpe:2.3:a:mongodb:mongodb:*:*:*:*:*:*:*:*≥ 4.0.0 < 4.0.11
Affected products
| Product | Versions |
|---|---|
| MongoDB Inc. · MongoDB Server | affected 4.0 < 4.0.11 ; affected 3.6 < 3.6.14 ; affected 3.4 < 3.4.22 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |