CVE-2019-2389CWE-732

Process termination via PID file manipulation

Medium · published August 30, 2019

CVSS v3.1
5.3
EPSS
0%
Percentile
21.8
In the wild
Unconfirmed
What it is

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.8th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2019-08-30T14:41Z
EPSS history
Timeline
  • 30 AUG 14:41Z
    Process termination via PID file manipulation
    cvelistv5