Vulnerability Description
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opscode | Chef | <= 0.8.10 |
Related Weaknesses (CWE)
References
- http://tickets.opscode.com/browse/CHEF-1289
- https://github.com/opscode/chef/commit/c3bb41f727fbe00e5de719d687757b24c8dcdfc8Patch
- http://tickets.opscode.com/browse/CHEF-1289
- https://github.com/opscode/chef/commit/c3bb41f727fbe00e5de719d687757b24c8dcdfc8Patch
FAQ
What is CVE-2010-5142?
CVE-2010-5142 is a vulnerability with a CVSS score of 6.5 (MEDIUM). chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users...
How severe is CVE-2010-5142?
CVE-2010-5142 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-5142?
Check the references section above for vendor advisories and patch information. Affected products include: Opscode Chef.