CVE-2010-5142

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...

PT-2012-2076

Name of the Vulnerable Software and Affected Versions Chef Server versions prior to 0.9.20 Chef Server versions 0.10.x prior to 0.10.6 Description The issue allows remote authenticated users to bypass intended access restrictions. This is possible because the clients.rb controller in Chef Server...

PT-2012-1354

Name of the Vulnerable Software and Affected Versions Chef versions prior to 0.9.0 Description The issue allows remote authenticated users to manage user accounts without requiring administrative privileges. This is due to the lack of proper access control in the create, destroy, and update...

PT-2012-2075

Name of the Vulnerable Software and Affected Versions Chef Server versions prior to 0.9.18 Chef Server versions 0.10.x prior to 0.10.2 Description The issue allows remote authenticated users to upload or delete cookbooks without requiring administrative privileges. This can be achieved via the...

CVE-2010-5142: Undefined Security Weakness

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...

CVE-2011-5097: Undefined Security Weakness

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...

CVE-2011-5098: Undefined Security Weakness

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the...

Chef Improper Access Control Vulnerability

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI...