CVE-2016-4474 Hardcoded credentials in n/a
Attackers can gain unauthorized access to Red Hat OpenStack Platform images due to a hardcoded default root password.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-4474?
CVE-2016-4474 is a high-severity vulnerability in Redhat Openstack, published on 30 Jun 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The image build process for the overcloud images in Red Hat OpenStack Platform 8.0 (Liberty) director and Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) director (aka overcloud-full) use a default root password of ROOTPW, which allows attackers to gain access via unspecified vectors.
Which versions are affected by CVE-2016-4474?
It affects 1 product.
Linux distribution packages (2)
rhosp-director-images Red Hat:openstack-director:8::el7 | All versions | 0:8.0-20160603.2.el7ost |
rhosp-director-images-ipa Red Hat:openstack-director:8::el7 | All versions | 0:8.0-20160603.2.el7ost |
Products include Redhat Openstack.
How do I fix CVE-2016-4474?
Apply the vendor's patch.
Is CVE-2016-4474 being exploited?
There is no known exploitation of CVE-2016-4474 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
Sources
Also known as GHSA-pgc6-fg9r-vjj4, RHSA-2016:1222.