What’s Vulnerable › Vulnerabilities

CVE-2014-9000

• Severity: medium (CVSS 6.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 8.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-11-20 · updated 2026-06-17
• Weakness: CWE-264

Description

Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.

Affected products

• MuleSoft Mule Enterprise Management Console: all versions

References

• http://packetstormsecurity.com/files/128799
• http://seclists.org/fulldisclosure/2014/Oct/107
• http://seclists.org/fulldisclosure/2014/Oct/98
• http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update
• http://packetstormsecurity.com/files/128799
• http://seclists.org/fulldisclosure/2014/Oct/107
• http://seclists.org/fulldisclosure/2014/Oct/98
• http://www.mulesoft.org/documentation/display/current/Mule+Enterprise+Management+Console+Security+Update

Get alerted when CVE-2014-9000 or the next vulnerability affects your stack