CVE-2015-1842

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

The puppet manifests in the Red Hat openstack-puppet-modules package before 2014.2.13-2 uses a default password of CHANGEME for the pcsd daemon, which allows remote attackers to execute arbitrary shell commands via unspecified vectors.

Metrics

CVSS 2.0 10.0/10AV:N/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-255

Affected software

No affected versions have been published.

Timeline

Published
Apr 10, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-18434.3The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registCVE-2015-18444.0Foreman before 1.7.5 allows remote authenticated users to bypass organization and location restrictions by connecting through the REST API.CVE-2015-184510.0Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.CVE-2015-18467.8unzoo allows remote attackers to cause a denial of service (infinite loop and resource consumption) via unspecified vectors to the (1) ExtrACVE-2015-18477.5Directory traversal vulnerability in the web request/response interface in Appserver before 1.0.3 allows remote attackers to read normally iCVE-2015-18486.8The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for reCVE-2015-18495.9AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive informationCVE-2015-18516.8OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticateCVE-2015-18524.3The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verificatCVE-2015-18536.5chrony before 1.31.1 does not properly protect state variables in authenticated symmetric NTP associations, which allows remote attackers wiCVE-2015-18547.5389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapCVE-2015-18555.9verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does no
CVE-2015-1842: Critical severity, CVSS 10.0 | Vulnix