CVE-2015-5222

HighCVSS 8.5/10Last modified Jun 17, 2026

Description

Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods via unspecified vectors.

Metrics

CVSS 2.0 8.5/10AV:N/AC:M/Au:S/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

No affected versions have been published.

Timeline

Published
Aug 24, 2015
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-52235.0OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest tCVE-2015-52249.8The mkostemp function in login-utils in util-linux when used incorrectly allows remote attackers to cause file name collision and possibly oCVE-2015-52257.2Buffer overflow in the vnc_refresh_server_surface function in the VNC display driver in QEMU before 2.4.0.1 allows guest users to cause a deCVE-2015-52278.8The Landing Pages plugin before 1.9.2 for WordPress allows remote attackers to execute arbitrary code via the url parameter.CVE-2015-52287.8The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of eCVE-2015-52297.5The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which migCVE-2015-52307.5The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denCVE-2015-52315.5The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive informaCVE-2015-52328.1Race conditions in opa-fm before 10.4.0.0.196 and opa-ff before 10.4.0.0.197.CVE-2015-52334.2Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with tCVE-2015-52346.8IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets intoCVE-2015-52354.3IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to