CVE-2015-5222
OpenShift3: Exec operations should be forbidden to privileged pods such as builder pods
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.
Vulnerabilidad en Red Hat OpenShift Enterprise 3.0.0.0 no verifica correctamente los permisos lo cual permite a usuarios remotos autenticados con permisos de creación ejecutar arbitrariamente comandos shell con permisos root sobre pods creados a través de vectores no especificados.
An improper permission check issue was discovered in the server admission control component in OpenShift. A user with build permissions could use this flaw to execute arbitrary shell commands on a build pod with the privileges of the root user.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-07-01 CVE Reserved
- 2015-08-21 CVE Published
- 2024-08-06 CVE Updated
- 2024-11-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
- CWE-862: Missing Authorization
CAPEC
References (3)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2015:1650 | 2023-02-13 | |
| https://access.redhat.com/security/cve/CVE-2015-5222 | 2015-08-20 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1255120 | 2015-08-20 |