CVE-2014-9000
Mule Enterprise Management Console (MMC) does not properly restrict access to handler...
CVE-2014-9000 is a medium vulnerability (CVSS 6.5) in Mulesoft Mule Enterprise Management Console, published November 20, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.87%, the 95th percentile. No source names a fixed version.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 8.87%EPSS, 95th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Mulesoft ESB Runtime 3.5.1 - Privilege Escalation | 2014-10-27 |
What each source reports
NVD Score used
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
CVE-2014-9000- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
CVE-2014-9000- Updated
- 2026-11-02
EUVDEUVD-2014-8828No score
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
EUVD-2014-8828- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fcxw-jr7h-j53pNo score
Mule Enterprise Management Console (MMC) does not properly restrict access to handler...
Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.
- Record
GHSA-fcxw-jr7h-j53p- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.