Lucene search
HistoryOct 03, 2022 - 4:21 p.m.
CVE-2010-5142
cve-2010-5142
chef
administrative privileges
user accounts
api
security vulnerability
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.5 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
59.4%
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
Affected configurations
Node
opscodechefRange≤0.8.10
ORopscodechefMatch0.7.2
ORopscodechefMatch0.7.4
ORopscodechefMatch0.7.6
ORopscodechefMatch0.7.8
ORopscodechefMatch0.7.10
ORopscodechefMatch0.7.12
ORopscodechefMatch0.7.14
ORopscodechefMatch0.8.2
ORopscodechefMatch0.8.4
ORopscodechefMatch0.8.6
ORopscodechefMatch0.8.8
Related
debiancve
debiancve
CVE-2010-5142
2022-10-03 16:21:03
prion
prion
Design/Logic Flaw
2012-08-08 10:26:00
cvelist
cvelist
CVE-2010-5142
2022-10-03 16:21:03
osv
osv
Chef Improper Access Control vulnerability
2022-05-17 05:26:20
ubuntucve
ubuntucve
CVE-2010-5142
2012-08-08 00:00:00
nvd
nvd
CVE-2010-5142
2012-08-08 10:26:17
github
github
Chef Improper Access Control vulnerability
2022-05-17 05:26:20
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
6.5 Medium
AI Score
Confidence
Low
0.002 Low
EPSS
Percentile
59.4%
Related for CVE-2010-5142