Chef Improper Access Control Vulnerability
Published: August 08, 2012
SECURITY IDENTIFIERS
- CVE: CVE-2010-5142 (NVD)
- GHSA: GHSA-f68m-q26r-64f6
GEM
SEVERITY
CVSS v2.0: 6.5 (Medium)
PATCHED VERSIONS
>= 0.9.0
DESCRIPTION
chef-server-api/app/controllers/users.rb in the API in Chef before
0.9.0 does not require administrative privileges for the create,
destroy, and update methods, which allows remote authenticated
users to manage user accounts via requests to the /users URI.