Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-2389

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

Published

2019-08-30T15:15:10.987

Last Modified

2024-11-21T04:40:46.587

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.3 (MEDIUM)

CVSSv2 Vector

AV:L/AC:M/Au:N/C:N/I:N/A:P

  • Access Vector: LOCAL
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

3.4

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-732
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application mongodb mongodb < 3.4.22 Yes
Application mongodb mongodb < 3.6.14 Yes
Application mongodb mongodb < 4.0.11 Yes
References