Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

chef chef vulnerabilities and exploits

(subscribe to this query)
6.5
CVSSv2
CVE-2011-5098
chef-server-api/app/controllers/clients.rb in Chef Server in Chef prior to 0.9.20, and 0.10.x prior to 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read ...
Opscode ChefOpscode Chef 0.9.16Opscode Chef 0.9.4Opscode Chef 0.8.4Opscode Chef 0.7.14Opscode Chef 0.7.10Opscode Chef 0.6.2Opscode Chef 0.5.6Opscode Chef 0.5.2Opscode Chef 0.10.0Opscode Chef 0.10.2Opscode Chef 0.10.4Opscode Chef 0.8.8Opscode Chef 0.8.10Opscode Chef 0.8.16Opscode Chef 0.8.14Opscode Chef 0.5.1Opscode Chef 0.9.12Opscode Chef 0.9.10Opscode Chef 0.9.6Opscode Chef 0.9.8Opscode Chef 0.9.2
5.5
CVSSv2
CVE-2011-5097
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef prior to 0.9.18, and 0.10.x prior to 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upl...
Opscode ChefOpscode Chef 0.9.14Opscode Chef 0.7.6Opscode Chef 0.7.4Opscode Chef 0.7.2Opscode Chef 0.7.14Opscode Chef 0.7.12Opscode Chef 0.9.12Opscode Chef 0.9.8Opscode Chef 0.8.4Opscode Chef 0.8.10Opscode Chef 0.7.8Opscode Chef 0.9.4Opscode Chef 0.9.2Opscode Chef 0.9.0Opscode Chef 0.8.8Opscode Chef 0.9.10Opscode Chef 0.9.6Opscode Chef 0.8.6Opscode Chef 0.8.2Opscode Chef 0.7.10Opscode Chef 0.10.0
7.5
CVSSv2
CVE-2017-7174
The user-account creation feature in Chef Manage 2.1.0 up to and including 2.4.4 allows remote malicious users to execute arbitrary code. This is fixed in 2.4.5.
Chef Manage Project Chef Manage 2.4.4Chef Manage Project Chef Manage 2.4.1Chef Manage Project Chef Manage 2.4.0Chef Manage Project Chef Manage 2.3.0Chef Manage Project Chef Manage 2.2.1Chef Manage Project Chef Manage 2.4.3Chef Manage Project Chef Manage 2.4.2Chef Manage Project Chef Manage 2.1.1Chef Manage Project Chef Manage 2.1.0Chef Manage Project Chef Manage 2.2.0Chef Manage Project Chef Manage 2.1.2
6.5
CVSSv2
CVE-2010-5142
chef-server-api/app/controllers/users.rb in the API in Chef prior to 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
Opscode Chef 0.7.8Opscode Chef 0.7.6Opscode Chef 0.7.4Opscode Chef 0.7.2Opscode Chef 0.8.2Opscode Chef 0.7.12Opscode ChefOpscode Chef 0.8.8Opscode Chef 0.8.6Opscode Chef 0.8.4Opscode Chef 0.7.14Opscode Chef 0.7.10
5
CVSSv2
CVE-2015-8559
The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.
Chef Chef
7.5
CVSSv2
CVE-2016-4326
The Chef Manage (formerly opscode-manage) add-on prior to 1.12.0 for Chef allows remote malicious users to execute arbitrary code via crafted serialized data in a cookie.
Chef Chef Manage
NA
CVE-2023-42658
Archive command in Chef InSpec before 4.56.58 and 5.22.29 allow local command execution via maliciously crafted profile.
Chef Inspec
NA
CVE-2023-40050
Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.
Chef Automate
6.5
CVSSv2
CVE-2022-25208
A missing permission check in Jenkins Chef Sinatra Plugin 1.20 and previous versions allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse an XML response.
Jenkins Chef Sinatra
4.3
CVSSv2
CVE-2019-1003086
A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation method allows malicious users to initiate a connection to an attacker-specified server.
Jenkins Chef Sinatra
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
SSTICVE-2024-35863CVE-2024-35910man-in-the-middleCVE-2024-35912CVE-2024-25742LFICVE-2024-32002CVE-2024-22120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook