Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2014-3496

cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.

Published

2014-06-20T14:55:07.030

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 10.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-94
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat openshift 1.2.8 Yes
Application redhat openshift 2.0 Yes
Application redhat openshift 2.0.1 Yes
Application redhat openshift 2.0.2 Yes
Application redhat openshift 2.0.3 Yes
Application redhat openshift 2.0.4 Yes
Application redhat openshift 2.0.5 Yes
Application redhat openshift 2.0.6 Yes
Application redhat openshift 2.1 Yes
Application redhat openshift 2.1.1 Yes
Application redhat openshift_origin 1.2.8 Yes
Application redhat openshift_origin 2.1 Yes
Application redhat openshift_origin 2.1.1 Yes
References