mongodb -- Our init scripts check /proc/[pid]/stat should validate that `(${procname})` is the process' command name.

2019-08-0600:00:00

vuxml.freebsd.org

4.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

1.9 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:N/I:N/A:P

0.0004 Low

EPSS

Percentile

11.7%

JSON

Sicheng Liu of Beijing DBSEC Technology Co., Ltd reports:

Incorrect scoping of kill operations in MongoDB Server’s packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchmongodb34< 3.4.22UNKNOWN
FreeBSDanynoarchmongodb36< 3.6.14UNKNOWN
FreeBSDanynoarchmongodb40< 4.0.11UNKNOWN