« Volver al listado

CVE-2010-5142

Estado: ModificadaMedia (6.5)—

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Opscode — Chef

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-5142",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-08-08T10:26:17.503",
  "references": [
    {
      "url": "http://tickets.opscode.com/browse/CHEF-1289",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/opscode/chef/commit/c3bb41f727fbe00e5de719d687757b24c8dcdfc8",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://tickets.opscode.com/browse/CHEF-1289",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/opscode/chef/commit/c3bb41f727fbe00e5de719d687757b24c8dcdfc8",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI."
    },
    {
      "lang": "es",
      "value": "chef-server-api/app/controllers/users.rb en la API en Chef anterior a v0.9.0 no requieren privilegios administrativos para crear, destruir, y métodos de actualización, que permite a usuarios remotos autenticados administrar cuentas de usuario a través de solicitudes a los usuarios URI."
    }
  ],
  "lastModified": "2026-06-16T23:26:10.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opscode:chef:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56BED2E7-173C-4990-AD1E-061B006C0083",
              "versionEndIncluding": "0.8.10"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4303E45B-3CC7-4F86-9AA3-9DE9E340DDB7"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DE318AD-5737-453F-90B9-449A3593887E"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0FB009E-708B-41BE-98E3-0548204A594A"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C369798E-2499-4DD5-8C13-F7A3D0BCAED9"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E247C8C9-7404-4920-9CA8-91316483CF01"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0189B6A3-9D58-40D7-BB42-101A600B5014"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97B55226-BC34-4060-A37D-8317B8BFB43B"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E624C53F-1755-4E88-B575-1AB92781A06C"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAA73864-4852-47D9-9EB9-A2AD654D0BAC"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "112F8AEB-9DD0-4A68-B69C-B677BE373DAE"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C6B61EE-2F0D-49DC-ADFD-D0A25A21B8B6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}