What is the CVSS score of CVE-2014-3684?

CVE-2014-3684 has a CVSS 2.0 base score of 6.8 (Medium). CVSS vector: AV:N/AC:L/Au:S/C:N/I:N/A:C. EPSS exploitation probability: 2.4%.

Torque Resource Manager CVE-2014-3684

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2014-10-30 secalert@redhat.com

Privilege Escalation Torque Resource Manager

6.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:L/Au:S/C:N/I:N/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:N/I:N/A:C

Attack Vector

Network

Attack Complexity

Low

Confidentiality

None

Integrity

None

Availability

Lifecycle Timeline

CVE Published

Oct 30, 2014 - 14:55 cve.org

MEDIUM 6.8

DescriptionCVE.org

The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary processes via a crafted executable.

AnalysisAI

The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary processes via a crafted executable. Affected products include: Adaptivecomputing Torque Resource Manager.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.