Vulnerability Details : CVE-2014-0233
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
Products affected by CVE-2014-0233
- cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift:2.1:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-0233
0.33%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 70 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-0233
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST |
CWE ids for CVE-2014-0233
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-0233
-
http://rhn.redhat.com/errata/RHSA-2014-0530.html
RHSA-2014:0530 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1096955
1096955 – (CVE-2014-0233) CVE-2014-0233 OpenShift: downloadable cartridge source url file command execution as rootExploit
-
http://rhn.redhat.com/errata/RHSA-2014-0529.html
RHSA-2014:0529 - Security Advisory - Red Hat Customer PortalVendor Advisory
Jump to