Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2019-13116

The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections

VectorNETWORK

PublishedOct 16, 2019, 20:15

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.mule.runtime:mule(Maven)03.8.0N/A

References

https://docs.mulesoft.com/release-notes/mule-runtime/mule-3.8.0-release-notes
https://threat.tevora.com/mulesoft-3-8-unauthenticated-rce/

Weakness Type

CWE-502

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK