CVE-2014-9000
Mule Enterprise Management Console (MMC) does not properly restrict access to handler...
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
Exploit likelihood
What each source reports
NVD Score used
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
CVE-2014-9000- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
CVE-2014-9000- Updated
- 2026-11-02
EUVDEUVD-2014-8828 No score
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
EUVD-2014-8828- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fcxw-jr7h-j53p No score
Mule Enterprise Management Console (MMC) does not properly restrict access to handler...
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
GHSA-fcxw-jr7h-j53p- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Mulesoft ESB Runtime 3.5.1 - Privilege Escalation | 2014-10-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9000 is a medium vulnerability (CVSS 6.5) in Mulesoft Mule Enterprise Management Console, published November 20, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.87%, the 95th percentile. No source names a fixed version.