CVE-2010-5142 | BDVDB-2026-51401 Detail

Description#

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12012-08-08Record published in the CVE List.
2. Version 22024-09-16Most recent update recorded in the CVE List.