Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: Opscode Component: Chef Clear all filters
TI-2011-04375 CVE-2011-5098 · GHSA-q923-fjjc-9frg

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and…

Priority LOW 32

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01681 Published 2012-08-08 No fix listed CWE-264
TI-2011-04374 CVE-2011-5097 · GHSA-67p8-9f9j-9rxq

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and…

Priority LOW 28

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticate…

CVSS 2.0MEDIUM 5.5 Network Low privileges Interaction — EPSS 0.01423 Published 2012-08-08 No fix listed CWE-264
TI-2010-04840 CVE-2010-5142 · GHSA-f68m-q26r-64f6

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require…

Priority LOW 32

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user acco…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0157 Published 2012-08-08 Fixed in 0.9.0 CWE-264