CVE-2011-5097

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...

CVE-2011-5097

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...

CVE-2011-5097

The CVE-2011-5097 issue affects Chef Server’s API: chef-server-api/app/controllers/cookbooks.rb in Chef Server versions before 0.9.18 and 0.10.x before 0.10.2. The root cause is that update and destroy actions do not require administrative privileges, allowing remote authenticated users to upload...