CVE-2019-2389: mongodb inc mongodb server
Vulnerability summary
CVE-2019-2389 is a medium (CVSS 5.3) vulnerability in mongodb inc mongodb server. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities.
Timeline
- 30-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Incorrect scoping of kill operations in MongoDB Server's packaged SysV init scripts allow users with write access to the PID file to insert arbitrary PIDs to be killed when the root user stops the MongoDB process via SysV init. This issue affects MongoDB Server v4.0 versions prior to 4.0.11; MongoDB Server v3.6 versions prior to 3.6.14; MongoDB Server v3.4 versions prior to 3.4.22.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST4.2MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Affected systems
Mongodb1 product
- mongodb≥ 3.4.0, < 3.4.22 | ≥ 3.6.0, < 3.6.14 | ≥ 4.0.0, < 4.0.11
Mongodb inc1 product
- mongodb server≥ 4.0, < 4.0.11 | ≥ 3.6, < 3.6.14 | ≥ 3.4, < 3.4.22
2 vendors · 2 products