CVE-2014-0234
9.8
CRITICAL · CVSS 3.1 · EPSS 3.8% (pctl 90)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.79% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-1188 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-02-12 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| redhat | openshift |
References
- http://openwall.com/lists/oss-security/2014/06/05/19
- http://www.securityfocus.com/bid/67657
- https://bugzilla.redhat.com/show_bug.cgi?id=1097008
- https://github.com/openshift/openshift-extras/blob/master/README.md
- https://rhn.redhat.com/errata/RHSA-2014-0487.html
- http://openwall.com/lists/oss-security/2014/06/05/19
- http://www.securityfocus.com/bid/67657
- https://bugzilla.redhat.com/show_bug.cgi?id=1097008
- https://github.com/openshift/openshift-extras/blob/master/README.md
- https://rhn.redhat.com/errata/RHSA-2014-0487.html
→ the Explorer · watch your stack · NVD