The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade CharLSUpgrade ruby193-rubygem-daemonsUpgrade jenkins-plugin-openshiftUpgrade icuUpgrade php-pear-MDB2Upgrade jboss-openshift-metrics-moduleUpgrade ruby193-ruby-mysqlUpgrade openshift-origin-cartridge-postgresqlUpgrade libcgroupUpgrade json-cUpgrade jenkinsUpgrade xerces-cUpgrade perl-DateTime-Format-PgUpgrade openshift-origin-port-proxyUpgrade rubygem-commanderUpgrade geosUpgrade openshift-origin-cartridge-mysqlUpgrade php-extrasUpgrade ruby193-ruby-selinuxUpgrade ruby193-rubygem-term-ansicolorUpgrade python27-numpyUpgrade openshift-origin-cartridge-nodejsUpgrade libreadline-javaUpgrade lcmsUpgrade ruby193-rubygem-sexp_processorUpgrade ruby193-rubygem-file-tailUpgrade nodejs010-nodejs-sendUpgrade hdf5Upgrade nodejs010-nodejs-commanderUpgrade ruby193-rubygem-bson_extUpgrade ta-libUpgrade openshift-origin-logshifterUpgrade rubygem-file-tailUpgrade jsUpgrade ruby193-rubygem-highlineUpgrade atlasUpgrade perl-DBIx-ContextualFetchUpgrade openshift-origin-cartridge-phpUpgrade yum-utilsUpgrade rubygem-nokogiriUpgrade rubygem-ParseTreeUpgrade ruby193-rubygem-fastthreadUpgrade jythonUpgrade python27-python-pipUpgrade libgeotiffUpgrade openshift-origin-node-proxyUpgrade perl-DateTime-Format-BuilderUpgrade jboss-eap6-indexUpgrade rubygem-openshift-origin-dns-nsupdateUpgrade ruby193-rubygem-mongoUpgrade socatUpgrade libdapUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade rubygem-net-sshUpgrade nodejs010-nodejs-bsonUpgrade perl-Ima-DBIUpgrade libwebpUpgrade rubygem-reginUpgrade ruby193-facterUpgrade ruby193-rubygem-safe_yamlUpgrade ruby193-rubygem-net-ldapUpgrade rubygem-openshift-origin-frontend-apachedbUpgrade php-pecl-imagickUpgrade nodejs010-nodejs-bignumber.jsUpgrade ruby193-rubygem-jquery-railsUpgrade lapackUpgrade postgresql92-postgisUpgrade openshift-origin-cartridge-haproxyUpgrade nodejs010-nodejs-tinycolorUpgrade nodejs010-nodejs-expressUpgrade rubygem-archive-tar-minitarUpgrade openshift-origin-cartridge-mockUpgrade ruby193-rubygem-systemuUpgrade perl-Class-Data-InheritableUpgrade libmcryptUpgrade nodejs010-nodejs-buffer-crc32Upgrade ruby193-rubygem-stompUpgrade php-pecl-xdebugUpgrade libevUpgrade rubygem-openshift-origin-auth-remote-userUpgrade openshift-origin-cartridge-jbossewsUpgrade ruby193-rubygem-compassUpgrade ruby193-rubygem-rest-clientUpgrade ruby-mysqlUpgrade armadilloUpgrade rhcUpgrade ruby193-rubygem-xml-simpleUpgrade php54-php-pecl-imagickUpgrade projUpgrade nodejs010-nodejs-range-parserUpgrade openshift-origin-cartridge-dependenciesUpgrade perl-YAMLUpgrade nodejs010-nodejs-wsUpgrade rubygem-diff-lcsUpgrade nodejs010-nodejs-mysqlUpgrade nodejs010-nodejs-mongodbUpgrade ruby193-rubygem-hamlUpgrade rubygem-parseconfigUpgrade libffiUpgrade rubygem-jsonUpgrade ruby193-rubygem-compass-railsUpgrade ruby193-rubygem-chunky_pngUpgrade libestrUpgrade ruby-RMagickUpgrade jboss-eap6-modulesUpgrade perl-CloneUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade python27-mod_wsgiUpgrade rubygem-openshift-origin-commonUpgrade rubygem-rackUpgrade nodejs010-nodejs-node-staticUpgrade rubygem-openshift-origin-routing-activemqUpgrade openshift-origin-cartridge-diyUpgrade ruby193-rubygem-bsonUpgrade cfitsioUpgrade pam_openshiftUpgrade ruby193-rubygem-ruby_parserUpgrade openshift-origin-cartridge-pythonUpgrade mongodbUpgrade nodejs010-nodejs-supervisorUpgrade ruby193-rubygem-syslog-loggerUpgrade nodejs010-nodejs-optimistUpgrade haproxy15sideUpgrade openshift-origin-node-utilUpgrade ruby193-rubygem-open4Upgrade ruby193-rubygem-pgUpgrade rubygem-systemuUpgrade perl-JSONUpgrade rubygem-thorUpgrade openshift-origin-cartridge-mock-pluginUpgrade ruby193-rubygem-jsonUpgrade rubygem-httpclientUpgrade shapelibUpgrade libgtaUpgrade rubygem-net-scpUpgrade ruby193-rubygem-mopedUpgrade nodejs010-nodejs-bytesUpgrade rubygem-thread-dumpUpgrade nodejs010-nodejs-formidableUpgrade perl-Class-TriggerUpgrade phpUpgrade perl-DateTime-Format-StrptimeUpgrade ruby193-rubygem-commanderUpgrade php-pear-MDB2-Driver-pgsqlUpgrade nodejs010-nodejs-cookieUpgrade rubygem-highlineUpgrade nodejs010-nodejs-pauseUpgrade freexlUpgrade rubygem-open4Upgrade libspatialiteUpgrade libc-clientUpgrade rubygem-rakeUpgrade ruby193-rubygem-fssmUpgrade ruby193-rubygem-sass-twitter-bootstrapUpgrade openshift-origin-msg-node-mcollectiveUpgrade openshift-origin-cartridge-jenkinsUpgrade php54-php-pecl-xdebugUpgrade perl-IO-stringyUpgrade ruby193-rubygem-mongoidUpgrade ruby193-rubygem-ruby2rubyUpgrade rubygem-net-ssh-multiUpgrade rubygem-spruzUpgrade quartzUpgrade activemqUpgrade nodejs010-nodejs-generic-poolUpgrade rubygemsUpgrade openshift-origin-cartridge-jenkins-clientUpgrade nodejs010-nodejs-connectUpgrade rubygem-bundlerUpgrade ruby193-rubygem-json_pureUpgrade v8Upgrade ruby193-rubygem-dnsrubyUpgrade nodejs010-nodejs-optionsUpgrade ruby193-rubygem-passengerUpgrade rubygem-ZenTestUpgrade nodejs010-nodejs-methodsUpgrade nodejs010-nodejs-colorsUpgrade ruby193-mcollectiveUpgrade rubygem-openshift-origin-nodeUpgrade rubygem-sexp_processorUpgrade rubygem-stompUpgrade rubygem-sqlite3Upgrade perl-Class-AccessorUpgrade org.apache.maven-mavenUpgrade uuidUpgrade ruby193-jsUpgrade postgresql92-pgRoutingUpgrade ruby193-rubygem-parallelUpgrade rsyslog7Upgrade openshift-enterprise-upgradeUpgrade gpsbabelUpgrade nodejs010-nodejs-debugUpgrade nodejs010-nodejs-require-allUpgrade jasperUpgrade openshift-origin-cartridge-cronUpgrade ruby193-rubygem-originUpgrade nodejs010-nodejs-wordwrapUpgrade ruby193-rubygem-formtasticUpgrade perl-App-cpanminusUpgrade facterUpgrade perl-Class-DBI-PgUpgrade perl-UNIVERSAL-monikerUpgrade ruby193-rubygem-daemon_controllerUpgrade postgisUpgrade postgresql-ip4rUpgrade ruby193-rubygem-rdiscountUpgrade rubygem-ruby_parserUpgrade ImageMagickUpgrade haproxyUpgrade rubygem-openshift-origin-consoleUpgrade rubygem-bsonUpgrade ghostscriptUpgrade rubygem-openshift-origin-container-selinuxUpgrade nodejs010-nodejs-pgUpgrade openshift-origin-msg-commonUpgrade python-virtualenvUpgrade rubygem-net-ssh-gatewayUpgrade nodejs010-nodejs-freshUpgrade rubygem-openshift-origin-frontend-apache-mod-rewriteUpgrade gdUpgrade nodejs010-nodejs-keypressUpgrade ruby193-rubygem-parseconfigUpgrade openshift-origin-util-sclUpgrade openshift-origin-broker-utilUpgrade openshift-origin-cartridge-perlUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade rubygem-fastthreadUpgrade rubygem-openshift-origin-controllerUpgrade ruby193-ruby-wrapperUpgrade perl-Class-Factory-UtilUpgrade rubygem-passengerUpgrade ruby193-rubygem-spruzUpgrade gdalUpgrade rubygem-ruby2rubyUpgrade rubygem-bson_extUpgrade netcdfUpgrade ruby193-rubygem-state_machineUpgrade rubygem-openshift-origin-frontend-nodejs-websocketUpgrade rubygem-RubyInlineUpgrade ruby193-rubygem-httpclientUpgrade ruby193-rubygem-minitestUpgrade rubygem-openshift-origin-admin-consoleUpgrade openshift-origin-cartridge-rubyUpgrade ruby193-rubygem-reginUpgrade perl-Class-DBIUpgrade openshift-origin-brokerUpgrade rubygem-test-unitUpgrade openshift-origin-consoleUpgrade openshift-origin-cartridge-jbosseapUpgrade nodejs010-nodejs-cookie-signature | Oct 8, 2019 | May 14, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub