CVE-2015-5222
HighSummary
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, allowing remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods.
Risk Assessment
This vulnerability may lead to unauthorized access to the system and execution of malicious code, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to the latest version of Red Hat OpenShift that fixes permission checks and restricts the ability to execute commands by unauthorized users.
Other vulnerabilities in Red Hat OpenShift Enterprise 3.0.0.0
See all- CVE-2016-5409High
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.
- CVE-2016-3738High
Red Hat OpenShift Enterprise 3.2 improperly restricts access to STI builds, allowing remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.
- CVE-2016-3708High
Red Hat OpenShift Enterprise 3.2 with multi-tenant SDN enabled allows remote authenticated users to access network resources on restricted pods when a build is run in a namespace that would normally be isolated from other pods. The issue occurs with builder images that contain ONBUILD commands or lack a tar binary.
- CVE-2014-3674High
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, allowing remote attackers to access the network resources of arbitrary gears via unspecified vectors.
Original NVD description (English source)
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.