The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade rubygem-openshift-origin-frontend-apachedbUpgrade php54-php-pecl-xdebugUpgrade haproxy15sideUpgrade v8Upgrade freexlUpgrade postgresql92-postgisUpgrade haproxyUpgrade openshift-origin-cartridge-pythonUpgrade shapelibUpgrade rubygem-open4Upgrade openshift-origin-cartridge-jenkinsUpgrade jenkinsUpgrade nodejs010-nodejs-cookieUpgrade jythonUpgrade openshift-origin-cartridge-mock-pluginUpgrade php-pear-MDB2Upgrade perl-Class-AccessorUpgrade openshift-origin-cartridge-jenkins-clientUpgrade nodejs010-nodejs-connectUpgrade ruby193-rubygem-fssmUpgrade postgisUpgrade perl-CloneUpgrade netcdfUpgrade ImageMagickUpgrade ruby193-rubygem-chunky_pngUpgrade openshift-enterprise-upgradeUpgrade rhcUpgrade rubygem-net-sshUpgrade nodejs010-nodejs-freshUpgrade gdUpgrade nodejs010-nodejs-colorsUpgrade rubygem-openshift-origin-consoleUpgrade openshift-origin-cartridge-diyUpgrade perl-Class-TriggerUpgrade rubygem-net-scpUpgrade uuidUpgrade ruby193-rubygem-ruby_parserUpgrade ruby193-rubygem-daemon_controllerUpgrade rubygem-passengerUpgrade rubygem-rakeUpgrade gdalUpgrade CharLSUpgrade ruby193-rubygem-net-ldapUpgrade openshift-origin-cartridge-perlUpgrade nodejs010-nodejs-pauseUpgrade rubygem-sqlite3Upgrade rubygem-test-unitUpgrade rubygem-sexp_processorUpgrade openshift-origin-msg-commonUpgrade perl-IO-stringyUpgrade mongodbUpgrade ruby193-rubygem-originUpgrade nodejs010-nodejs-debugUpgrade icuUpgrade perl-Class-DBI-PgUpgrade ruby193-rubygem-httpclientUpgrade rubygem-bsonUpgrade openshift-origin-brokerUpgrade libdapUpgrade jasperUpgrade facterUpgrade ruby193-rubygem-mongoidUpgrade libgeotiffUpgrade ghostscriptUpgrade perl-UNIVERSAL-monikerUpgrade perl-Class-Factory-UtilUpgrade ruby193-rubygem-json_pureUpgrade jboss-openshift-metrics-moduleUpgrade ruby193-rubygem-pgUpgrade ruby193-rubygem-reginUpgrade nodejs010-nodejs-generic-poolUpgrade jenkins-plugin-openshiftUpgrade rubygem-stompUpgrade openshift-origin-logshifterUpgrade rubygem-nokogiriUpgrade rubygem-fastthreadUpgrade hdf5Upgrade rubygem-file-tailUpgrade python27-numpyUpgrade ruby193-rubygem-highlineUpgrade rubygem-openshift-origin-dns-nsupdateUpgrade rubygem-bundlerUpgrade yum-utilsUpgrade ruby193-rubygem-syslog-loggerUpgrade rubygem-bson_extUpgrade rubygem-highlineUpgrade rubygem-openshift-origin-controllerUpgrade perl-DateTime-Format-PgUpgrade openshift-origin-port-proxyUpgrade rubygem-openshift-origin-container-selinuxUpgrade perl-Ima-DBIUpgrade xerces-cUpgrade ruby193-rubygem-daemonsUpgrade php-extrasUpgrade rubygem-thread-dumpUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade activemqUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade rubygem-reginUpgrade postgresql-ip4rUpgrade nodejs010-nodejs-tinycolorUpgrade libcgroupUpgrade ruby193-rubygem-mopedUpgrade quartzUpgrade nodejs010-nodejs-optionsUpgrade ruby193-facterUpgrade nodejs010-nodejs-node-staticUpgrade rubygem-openshift-origin-admin-consoleUpgrade nodejs010-nodejs-bsonUpgrade ruby193-rubygem-rest-clientUpgrade rubygem-parseconfigUpgrade nodejs010-nodejs-cookie-signatureUpgrade openshift-origin-cartridge-phpUpgrade ruby193-rubygem-sexp_processorUpgrade openshift-origin-cartridge-postgresqlUpgrade php-pear-MDB2-Driver-pgsqlUpgrade ruby193-rubygem-compassUpgrade jsUpgrade openshift-origin-cartridge-jbosseapUpgrade openshift-origin-cartridge-mysqlUpgrade ruby193-rubygem-dnsrubyUpgrade perl-Class-DBIUpgrade rubygem-rackUpgrade ruby193-rubygem-formtasticUpgrade openshift-origin-cartridge-nodejsUpgrade rubygem-commanderUpgrade rubygem-openshift-origin-nodeUpgrade libffiUpgrade nodejs010-nodejs-supervisorUpgrade ruby193-rubygem-rdiscountUpgrade ta-libUpgrade projUpgrade phpUpgrade nodejs010-nodejs-sendUpgrade ruby193-rubygem-term-ansicolorUpgrade openshift-origin-node-utilUpgrade openshift-origin-cartridge-rubyUpgrade nodejs010-nodejs-require-allUpgrade nodejs010-nodejs-mysqlUpgrade nodejs010-nodejs-keypressUpgrade openshift-origin-cartridge-haproxyUpgrade perl-DBIx-ContextualFetchUpgrade ruby193-rubygem-bson_extUpgrade nodejs010-nodejs-wsUpgrade python27-python-pipUpgrade openshift-origin-util-sclUpgrade nodejs010-nodejs-bytesUpgrade ruby193-rubygem-spruzUpgrade libestrUpgrade rubygem-openshift-origin-auth-remote-userUpgrade ruby193-jsUpgrade openshift-origin-consoleUpgrade nodejs010-nodejs-buffer-crc32Upgrade rubygem-net-ssh-gatewayUpgrade openshift-origin-broker-utilUpgrade rubygem-spruzUpgrade json-cUpgrade perl-DateTime-Format-StrptimeUpgrade rubygemsUpgrade pam_openshiftUpgrade ruby193-ruby-selinuxUpgrade ruby-RMagickUpgrade rubygem-thorUpgrade rubygem-openshift-origin-frontend-nodejs-websocketUpgrade python27-mod_wsgiUpgrade ruby193-rubygem-parseconfigUpgrade rubygem-ZenTestUpgrade perl-DateTime-Format-BuilderUpgrade libevUpgrade ruby193-ruby-mysqlUpgrade geosUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade rsyslog7Upgrade python-virtualenvUpgrade libc-clientUpgrade perl-App-cpanminusUpgrade openshift-origin-cartridge-cronUpgrade rubygem-RubyInlineUpgrade ruby193-rubygem-minitestUpgrade ruby193-rubygem-stompUpgrade ruby193-ruby-wrapperUpgrade ruby193-rubygem-state_machineUpgrade rubygem-ruby_parserUpgrade ruby193-rubygem-jsonUpgrade rubygem-openshift-origin-frontend-apache-mod-rewriteUpgrade nodejs010-nodejs-pgUpgrade nodejs010-nodejs-wordwrapUpgrade ruby193-rubygem-commanderUpgrade nodejs010-nodejs-methodsUpgrade ruby193-rubygem-mongoUpgrade gpsbabelUpgrade rubygem-ruby2rubyUpgrade ruby193-rubygem-file-tailUpgrade perl-YAMLUpgrade libgtaUpgrade php-pecl-imagickUpgrade ruby193-rubygem-sass-twitter-bootstrapUpgrade ruby193-rubygem-jquery-railsUpgrade openshift-origin-cartridge-mockUpgrade ruby193-rubygem-bsonUpgrade ruby193-rubygem-systemuUpgrade nodejs010-nodejs-mongodbUpgrade ruby193-rubygem-xml-simpleUpgrade ruby193-rubygem-parallelUpgrade ruby193-rubygem-hamlUpgrade rubygem-jsonUpgrade armadilloUpgrade openshift-origin-cartridge-jbossewsUpgrade openshift-origin-node-proxyUpgrade openshift-origin-msg-node-mcollectiveUpgrade libspatialiteUpgrade nodejs010-nodejs-commanderUpgrade nodejs010-nodejs-bignumber.jsUpgrade ruby-mysqlUpgrade php-pecl-xdebugUpgrade atlasUpgrade perl-JSONUpgrade socatUpgrade libmcryptUpgrade rubygem-diff-lcsUpgrade rubygem-systemuUpgrade ruby193-mcollectiveUpgrade rubygem-httpclientUpgrade postgresql92-pgRoutingUpgrade ruby193-rubygem-open4Upgrade openshift-origin-cartridge-dependenciesUpgrade jboss-eap6-indexUpgrade php54-php-pecl-imagickUpgrade rubygem-openshift-origin-commonUpgrade rubygem-net-ssh-multiUpgrade ruby193-rubygem-fastthreadUpgrade org.apache.maven-mavenUpgrade perl-Class-Data-InheritableUpgrade nodejs010-nodejs-expressUpgrade ruby193-rubygem-ruby2rubyUpgrade nodejs010-nodejs-optimistUpgrade ruby193-rubygem-safe_yamlUpgrade cfitsioUpgrade lcmsUpgrade rubygem-ParseTreeUpgrade rubygem-openshift-origin-routing-activemqUpgrade libreadline-javaUpgrade libwebpUpgrade lapackUpgrade nodejs010-nodejs-range-parserUpgrade rubygem-archive-tar-minitarUpgrade ruby193-rubygem-compass-railsUpgrade jboss-eap6-modulesUpgrade ruby193-rubygem-passengerUpgrade nodejs010-nodejs-formidable | Oct 8, 2019 | May 14, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub