CVE-2014-9000: Mulesoft Mule Enterprise Management Console

Medium severity, CVSS 6.5. EPSS: 8.9% chance of exploitation in the next 30 days.

Mule Enterprise Management Console (MMC) does not properly restrict access to handler/securityService.rpc, which allows remote authenticated users to gain administrator privileges and execute arbitrary code via a crafted request that adds a new user. NOTE: this issue was originally reported for ESB Runtime 3.5.1, but it originates in MMC.

Affected products

• Mulesoft Mule Enterprise Management Console: affected versions not specified

Published 2014-11-20. Last modified 2026-06-17.