CVE-2010-5142: Medium severity Opscode Chef vulnerability
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
Other sources
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2010-5142?
CVE-2010-5142 is classified as a high severity vulnerability due to its potential impact on user account management.
How do I fix CVE-2010-5142?
To mitigate CVE-2010-5142, upgrade Chef to version 0.9.0 or later to enable proper administrative privilege checks.
What versions of Chef are affected by CVE-2010-5142?
CVE-2010-5142 affects Chef versions 0.8.10 and earlier, including all versions of 0.7.x.
What actions can be performed by exploiting CVE-2010-5142?
Exploitation of CVE-2010-5142 allows remote authenticated users to create, update, or delete user accounts via the /users API endpoint.
Is there a workaround for CVE-2010-5142 if an upgrade is not immediately possible?
If an upgrade is not feasible, limit access to the /users API endpoint to trusted users to mitigate the risk associated with CVE-2010-5142.