CVE-2010-5142

2022-10-0316:21:03

mitre

www.cve.org

chef server

api

administrative privileges

user accounts

remote authenticated users

6.3 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.4%

JSON

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.