CVE-2014-0234

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0234
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://openwall.com/lists/oss-security/2014/06/05/19 Exploit Mailing List Patch Third Party Advisory
http://www.securityfocus.com/bid/67657 Third Party Advisory VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1097008 Issue Tracking Vendor Advisory
https://github.com/openshift/openshift-extras/blob/master/README.md Third Party Advisory
https://rhn.redhat.com/errata/RHSA-2014-0487.html Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
History

13 Feb 2023, 00:37

Type Values Removed Values Added
Summary CVE-2014-0234 OpenShift Enterprise openshift-origin-broker: default password creation The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
References
  • {'url': 'https://access.redhat.com/errata/RHBA-2014:0487', 'name': 'https://access.redhat.com/errata/RHBA-2014:0487', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-0234', 'name': 'https://access.redhat.com/security/cve/CVE-2014-0234', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHBA-2014:0487 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-0234 -
Summary The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281. CVE-2014-0234 OpenShift Enterprise openshift-origin-broker: default password creation
Information

Published : 2020-02-12 01:15

Updated : 2023-12-10 13:13

NVD link : CVE-2014-0234

Mitre link : CVE-2014-0234

CVE.ORG link : CVE-2014-0234

JSON object : View

Products Affected

redhat

  • openshift
CWE
CWE-1188

Insecure Default Initialization of Resource