CVE-2014-3674
HighSummary
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, allowing remote attackers to access the network resources of arbitrary gears via unspecified vectors.
Risk Assessment
Attackers may gain access to sensitive network resources, potentially leading to data and service security breaches.
Recommendation
It is recommended to upgrade Red Hat OpenShift Enterprise to version 2.2 or later to mitigate this vulnerability.
Other vulnerabilities in Red Hat OpenShift Enterprise
See all- CVE-2016-5409High
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.
- CVE-2016-3738High
Red Hat OpenShift Enterprise 3.2 improperly restricts access to STI builds, allowing remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.
- CVE-2016-3708High
Red Hat OpenShift Enterprise 3.2 with multi-tenant SDN enabled allows remote authenticated users to access network resources on restricted pods when a build is run in a namespace that would normally be isolated from other pods. The issue occurs with builder images that contain ONBUILD commands or lack a tar binary.
- CVE-2015-5222High
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, allowing remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods.
Original NVD description (English source)
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, which allows remote attackers to access the network resources of arbitrary gears via unspecified vectors.