VULNERABILITY INTELLIGENCE

CVE-2019-2389

CVSS score5.3 MEDIUM
EPSS probability0.30%
CISA KEVNot currently listed
Published2019-08-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H

Description

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

Weakness classification

  • CWE-20: Improper Input Validation
  • CWE-732: Incorrect Permission Assignment for Critical Resource

Primary references