CVE-2014-0234 Hardcoded credentials in Red Hat OpenShift Enterprise
Remote attackers can hijack the broker by using the default hardcoded password for the Mongo account in the default configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0234?
CVE-2014-0234 is a critical vulnerability in Redhat Openshift, published on 12 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281.
Weakness: CWE-1188
Which versions are affected by CVE-2014-0234?
It affects 1 product.
Products include Redhat Openshift.
How do I fix CVE-2014-0234?
Upgrade to a fixed version.
Is CVE-2014-0234 being exploited?
There is no known exploitation of CVE-2014-0234 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openshift
Sources
Also known as GHSA-w87g-2vqm-6m24.