The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade openshift-origin-cartridge-perlUpgrade openshift-origin-cartridge-jbosseapUpgrade ruby193-rubygem-rdiscountUpgrade rubygem-net-sshUpgrade mongodbUpgrade rubygem-net-scpUpgrade nodejs010-nodejs-cookie-signatureUpgrade ruby193-rubygem-chunky_pngUpgrade rubygem-commanderUpgrade ruby193-rubygem-commanderUpgrade perl-IO-stringyUpgrade ruby193-rubygem-passengerUpgrade openshift-origin-brokerUpgrade nodejs010-nodejs-buffer-crc32Upgrade rubygem-net-ssh-multiUpgrade ruby193-rubygem-file-tailUpgrade openshift-origin-node-utilUpgrade rubygem-systemuUpgrade ruby193-rubygem-fastthreadUpgrade nodejs010-nodejs-bignumber.jsUpgrade openshift-origin-cartridge-dependenciesUpgrade ruby193-rubygem-jquery-railsUpgrade perl-DateTime-Format-BuilderUpgrade rubygem-httpclientUpgrade geosUpgrade ruby193-rubygem-pgUpgrade php54-php-pecl-xdebugUpgrade nodejs010-nodejs-mysqlUpgrade nodejs010-nodejs-commanderUpgrade nodejs010-nodejs-node-staticUpgrade rubygem-open4Upgrade libspatialiteUpgrade rubygem-archive-tar-minitarUpgrade hdf5Upgrade ruby193-rubygem-xml-simpleUpgrade php-pear-MDB2-Driver-pgsqlUpgrade nodejs010-nodejs-expressUpgrade ruby193-rubygem-bsonUpgrade xerces-cUpgrade rubygem-highlineUpgrade nodejs010-nodejs-cookieUpgrade openshift-origin-logshifterUpgrade ruby193-rubygem-mongoidUpgrade rubygem-sexp_processorUpgrade haproxy15sideUpgrade nodejs010-nodejs-formidableUpgrade perl-JSONUpgrade php-pecl-xdebugUpgrade php54-php-pecl-imagickUpgrade ruby193-ruby-selinuxUpgrade armadilloUpgrade ruby193-ruby-wrapperUpgrade ruby193-rubygem-ruby_parserUpgrade rubygem-stompUpgrade rsyslog7Upgrade ruby193-rubygem-mopedUpgrade lapackUpgrade ruby193-rubygem-httpclientUpgrade rubygem-sqlite3Upgrade openshift-origin-node-proxyUpgrade ruby193-rubygem-safe_yamlUpgrade rubygemsUpgrade ta-libUpgrade ruby193-rubygem-term-ansicolorUpgrade ruby193-mcollectiveUpgrade rubygem-file-tailUpgrade openshift-origin-cartridge-mockUpgrade openshift-origin-cartridge-jenkinsUpgrade ruby193-rubygem-ruby2rubyUpgrade openshift-origin-cartridge-nodejsUpgrade jboss-eap6-indexUpgrade ruby193-rubygem-compassUpgrade libgtaUpgrade nodejs010-nodejs-optimistUpgrade jsUpgrade rubygem-openshift-origin-dns-nsupdateUpgrade ruby193-rubygem-parallelUpgrade ruby193-rubygem-compass-railsUpgrade socatUpgrade rubygem-diff-lcsUpgrade rubygem-openshift-origin-routing-activemqUpgrade jboss-eap6-modulesUpgrade openshift-origin-cartridge-phpUpgrade rubygem-spruzUpgrade ruby193-rubygem-highlineUpgrade perl-DateTime-Format-PgUpgrade nodejs010-nodejs-mongodbUpgrade rubygem-openshift-origin-auth-remote-userUpgrade nodejs010-nodejs-range-parserUpgrade ruby193-rubygem-mongoUpgrade libestrUpgrade atlasUpgrade rubygem-openshift-origin-controllerUpgrade nodejs010-nodejs-wsUpgrade perl-Class-Data-InheritableUpgrade rubygem-openshift-origin-frontend-apachedbUpgrade ruby193-rubygem-dnsrubyUpgrade rubygem-bundlerUpgrade yum-utilsUpgrade rubygem-openshift-origin-frontend-haproxy-sni-proxyUpgrade libffiUpgrade openshift-origin-cartridge-mysqlUpgrade jythonUpgrade rubygem-ParseTreeUpgrade rubygem-bson_extUpgrade ruby193-rubygem-sass-twitter-bootstrapUpgrade jboss-openshift-metrics-moduleUpgrade nodejs010-nodejs-bsonUpgrade perl-DBIx-ContextualFetchUpgrade libwebpUpgrade rubygem-openshift-origin-frontend-apache-vhostUpgrade nodejs010-nodejs-pgUpgrade org.apache.maven-mavenUpgrade ruby-RMagickUpgrade postgisUpgrade ruby193-rubygem-daemonsUpgrade openshift-origin-cartridge-jbossewsUpgrade ruby193-rubygem-hamlUpgrade freexlUpgrade openshift-origin-cartridge-haproxyUpgrade perl-UNIVERSAL-monikerUpgrade libreadline-javaUpgrade rubygem-rackUpgrade php-extrasUpgrade rubygem-parseconfigUpgrade cfitsioUpgrade ruby193-rubygem-net-ldapUpgrade nodejs010-nodejs-bytesUpgrade ruby-mysqlUpgrade ruby193-rubygem-sexp_processorUpgrade ruby193-rubygem-systemuUpgrade ruby193-facterUpgrade ruby193-rubygem-json_pureUpgrade rubygem-openshift-origin-commonUpgrade libdapUpgrade nodejs010-nodejs-require-allUpgrade ruby193-rubygem-minitestUpgrade libmcryptUpgrade v8Upgrade postgresql92-pgRoutingUpgrade postgresql92-postgisUpgrade rubygem-fastthreadUpgrade ruby193-rubygem-fssmUpgrade rubygem-openshift-origin-nodeUpgrade rubygem-ZenTestUpgrade openshift-origin-cartridge-postgresqlUpgrade ruby193-rubygem-rest-clientUpgrade openshift-origin-cartridge-pythonUpgrade python27-numpyUpgrade nodejs010-nodejs-keypressUpgrade ruby193-rubygem-jsonUpgrade python27-python-pipUpgrade openshift-origin-msg-node-mcollectiveUpgrade shapelibUpgrade openshift-origin-port-proxyUpgrade phpUpgrade rubygem-nokogiriUpgrade rubygem-RubyInlineUpgrade json-cUpgrade lcmsUpgrade netcdfUpgrade ghostscriptUpgrade projUpgrade ruby193-rubygem-bson_extUpgrade ruby193-rubygem-open4Upgrade ruby193-rubygem-stompUpgrade perl-Class-TriggerUpgrade libevUpgrade ruby193-rubygem-originUpgrade nodejs010-nodejs-sendUpgrade rubygem-openshift-origin-consoleUpgrade openshift-origin-cartridge-cronUpgrade nodejs010-nodejs-supervisorUpgrade ruby193-rubygem-syslog-loggerUpgrade nodejs010-nodejs-tinycolorUpgrade openshift-origin-msg-commonUpgrade php-pecl-imagickUpgrade perl-YAMLUpgrade ruby193-rubygem-reginUpgrade rubygem-reginUpgrade gdUpgrade nodejs010-nodejs-generic-poolUpgrade haproxyUpgrade rubygem-openshift-origin-msg-broker-mcollectiveUpgrade nodejs010-nodejs-methodsUpgrade ruby193-rubygem-state_machineUpgrade perl-CloneUpgrade rhcUpgrade perl-DateTime-Format-StrptimeUpgrade openshift-origin-consoleUpgrade jenkins-plugin-openshiftUpgrade ruby193-rubygem-formtasticUpgrade rubygem-jsonUpgrade python27-mod_wsgiUpgrade postgresql-ip4rUpgrade python-virtualenvUpgrade perl-Ima-DBIUpgrade libgeotiffUpgrade openshift-origin-util-sclUpgrade nodejs010-nodejs-freshUpgrade nodejs010-nodejs-colorsUpgrade nodejs010-nodejs-pauseUpgrade rubygem-rakeUpgrade rubygem-ruby2rubyUpgrade php-pear-MDB2Upgrade ruby193-rubygem-parseconfigUpgrade rubygem-thread-dumpUpgrade jenkinsUpgrade openshift-origin-broker-utilUpgrade ruby193-rubygem-spruzUpgrade rubygem-net-ssh-gatewayUpgrade quartzUpgrade gpsbabelUpgrade ImageMagickUpgrade nodejs010-nodejs-optionsUpgrade openshift-origin-cartridge-mock-pluginUpgrade ruby193-rubygem-daemon_controllerUpgrade openshift-enterprise-upgradeUpgrade perl-Class-AccessorUpgrade gdalUpgrade nodejs010-nodejs-wordwrapUpgrade libc-clientUpgrade rubygem-ruby_parserUpgrade rubygem-openshift-origin-frontend-nodejs-websocketUpgrade rubygem-test-unitUpgrade rubygem-bsonUpgrade rubygem-openshift-origin-frontend-apache-mod-rewriteUpgrade libcgroupUpgrade uuidUpgrade facterUpgrade activemqUpgrade openshift-origin-cartridge-diyUpgrade perl-App-cpanminusUpgrade openshift-origin-cartridge-jenkins-clientUpgrade rubygem-openshift-origin-admin-consoleUpgrade nodejs010-nodejs-connectUpgrade icuUpgrade openshift-origin-cartridge-rubyUpgrade jasperUpgrade ruby193-jsUpgrade rubygem-thorUpgrade pam_openshiftUpgrade rubygem-passengerUpgrade perl-Class-DBIUpgrade perl-Class-Factory-UtilUpgrade nodejs010-nodejs-debugUpgrade ruby193-ruby-mysqlUpgrade perl-Class-DBI-PgUpgrade rubygem-openshift-origin-container-selinuxUpgrade CharLS | Oct 8, 2019 | May 14, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub