3 matches found
CVE-2011-5097
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...
CVE-2011-5097
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...
CVE-2011-5097
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to 1 upload cookbooks via a knife cookbook upload command or 2 delete...