CVE-2014-3674

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-3674
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2014-1796.html Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1906.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift:2.0.1:*:enterprise:*:*:*:*:*
cpe:2.3:a:redhat:openshift:2.0.2:*:enterprise:*:*:*:*:*
cpe:2.3:a:redhat:openshift:2.0.3:*:enterprise:*:*:*:*:*
cpe:2.3:a:redhat:openshift:2.0.4:*:enterprise:*:*:*:*:*
cpe:2.3:a:redhat:openshift:2.0.5:*:enterprise:*:*:*:*:*
cpe:2.3:a:redhat:openshift:2.0.6:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1.1:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1.2:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1.3:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1.4:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1.5:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1.6:*:*:*:enterprise:*:*:*
cpe:2.3:a:redhat:openshift:2.1.7:*:*:*:enterprise:*:*:*
History

13 Feb 2023, 00:41

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:1796', 'name': 'https://access.redhat.com/errata/RHSA-2014:1796', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1148170', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1148170', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-3674', 'name': 'https://access.redhat.com/security/cve/CVE-2014-3674', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:1906', 'name': 'https://access.redhat.com/errata/RHSA-2014:1906', 'tags': [], 'refsource': 'MISC'}
Summary It was found that OpenShift Enterprise 2.1 did not properly restrict access to services running on different gears. This could allow an attacker to access unprotected network resources running in another user's gear. Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors.

02 Feb 2023, 20:18

Type Values Removed Values Added
Summary Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors. It was found that OpenShift Enterprise 2.1 did not properly restrict access to services running on different gears. This could allow an attacker to access unprotected network resources running in another user's gear.
References
  • (MISC) https://access.redhat.com/errata/RHSA-2014:1796 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1148170 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-3674 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:1906 -
Information

Published : 2014-11-13 21:32

Updated : 2023-12-10 11:31

NVD link : CVE-2014-3674

Mitre link : CVE-2014-3674

CVE.ORG link : CVE-2014-3674

JSON object : View

Products Affected

redhat

  • openshift
CWE
CWE-264

Permissions, Privileges, and Access Controls