MuleSoft

Records6All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

MuleSoft records in CISA KEV

No MuleSoft vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mule Runtime 4 records MEDIUM Api Gateway 2 records MEDIUM Aplkit 1 record MEDIUM Mule Enterprise Management Console 1 record MEDIUM

Records

4 records in Mule Runtime · all components

TI-2019-09822 CVE-2019-13116 · GHSA-cvcf-w75c-gw5r

The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to…

MEDIUM 50

The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05128 Published 2019-10-16 Fixed in 3.8.0 CWE-502

TI-2019-11730 CVE-2019-15631 · GHSA-gp9r-cv63-32fj

Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x…

MEDIUM 47

Remote Code Execution vulnerability in MuleSoft Mule CE/EE 3.x and API Gateway 2.x released before October 31, 2019 allows remote attackers to execute arbitrary code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0234 Published 2019-12-02 No fix listed

TI-2019-11729 CVE-2019-15630 · GHSA-mwh9-gr45-xvv4

Path traversal in Salesforce Mulesoft

LOW 38

Directory Traversal in APIkit, HTTP connector, and OAuth2 Provider components in MuleSoft Mule Runtime 3.2.0 and higher released before August 1 2019, MuleSoft Mule Runtime 4.1.0 and higher released before August 1 2019,…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02998 Published 2019-08-30 No fix listed CWE-22

TI-2020-05597 CVE-2020-6937 · GHSA-5wpj-3hpx-gvfq

A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released…

LOW 35

A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01245 Published 2020-05-29 No fix listed

Open these records in search →

Critical	3
High	2
Medium	1
Low	0
No CVSS	0