CVE-2010-5142 Chef Improper Access Control vulnerability
MediumCVSS 6.5
EPSS 1.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems chef(RubyGems) | < 0.9.0 | 0.9.0 |
| rubygems chef(RubyGems) | = 0.7.10 | No fix listed |
| rubygems chef(RubyGems) | = 0.7.12 | No fix listed |
| rubygems chef(RubyGems) | = 0.7.14 | No fix listed |
| rubygems chef(RubyGems) | = 0.7.16 | No fix listed |
| rubygems chef(RubyGems) | = 0.8.10 | No fix listed |
| rubygems chef(RubyGems) | = 0.8.14 | No fix listed |
| rubygems chef(RubyGems) | = 0.8.16 | No fix listed |
| rubygems chef(RubyGems) | = 0.8.2 | No fix listed |
| rubygems chef(RubyGems) | = 0.8.4 | No fix listed |
| rubygems chef(RubyGems) | = 0.8.6 | No fix listed |
| rubygems chef(RubyGems) | = 0.8.8 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a10 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a3 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a4 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a6 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a8 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a90 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a91 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.a92 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.b01 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.b02 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.rc01 | No fix listed |
| rubygems chef(RubyGems) | = 0.9.0.rc02 | No fix listed |
| opscode chef | <= 0.8.10 | No fix listed |
Show 11 more
| Product | Affected versions | Fixed in |
|---|---|---|
| opscode chef | = 0.7.2 | No fix listed |
| opscode chef | = 0.7.4 | No fix listed |
| opscode chef | = 0.7.6 | No fix listed |
| opscode chef | = 0.7.8 | No fix listed |
| opscode chef | = 0.7.10 | No fix listed |
| opscode chef | = 0.7.12 | No fix listed |
| opscode chef | = 0.7.14 | No fix listed |
| opscode chef | = 0.8.2 | No fix listed |
| opscode chef | = 0.8.4 | No fix listed |
| opscode chef | = 0.8.6 | No fix listed |
| opscode chef | = 0.8.8 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- tickets.opscode.com
- github.com exploit
- github.com
- github.com product