What is the CVSS score of CVE-2014-9091?

CVE-2014-9091 has a CVSS 2.0 base score of 4.6 (Medium). CVSS vector: AV:L/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.1%.

Which versions of Icecast are affected by CVE-2014-9091?

Icecast before 2.4.0 does not change the supplementary group privileges when is configured, which allows local users to gain privileges via unspecified vectors.

Is there a public PoC exploit available for CVE-2014-9091?

Yes, a public proof-of-concept exploit is available for CVE-2014-9091. Prioritise patching immediately. EPSS: 0.1%.

Icecast CVE-2014-9091

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2014-12-10 cve@mitre.org

Privilege Escalation Icecast

4.6

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Dec 10, 2014 - 15:59 cve.org

MEDIUM 4.6

DescriptionCVE.org

Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors.

AnalysisAI

Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. Icecast before 2.4.0 does not change the supplementary group privileges when <changeowner> is configured, which allows local users to gain privileges via unspecified vectors. Affected products include: Icecast. Version information: before 2.4.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.