CVE-2019-2389

Process termination via PID file manipulation

State: Published
Severity: 5.3 Medium
Published: Aug 30, 2019
Updated: Aug 4, 2024
Reserved: Dec 10, 2018

Description

Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H	mongodb

Weaknesses

CWE-732 Incorrect Permission Assignment for Critical Resource

Affected Products

Product	Versions
MongoDB ServerMongoDB Inc.	4.0 to before 4.0.11Affected 3.6 to before 3.6.14Affected 3.4 to before 3.4.22Affected

References

https://jira.mongodb.org/browse/SERVER-40563

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.