« Volver al listado

CVE-2011-5097

Estado: ModificadaMedia (5.5)—

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Opscode — Chef

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-5097",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-08-08T10:26:18.173",
  "references": [
    {
      "url": "http://tickets.opscode.com/browse/CHEF-2436",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/opscode/chef/commit/a4ea6edab2fecb922f999cffb0daa04eeeec7a26",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://tickets.opscode.com/browse/CHEF-2436",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/opscode/chef/commit/a4ea6edab2fecb922f999cffb0daa04eeeec7a26",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command."
    },
    {
      "lang": "es",
      "value": "chef-server-api/app/controllers/cookbooks.rb en Chef Server en Chef anterior a v0.9.18, y v0.10.x anterior a v0.10.2, no requiere privilegios administrativos para actualizar y destruir métodos, lo que permite a usuarios remotos autenticados (1) subir (cookbooks) a través de un comando de subida de un (knife cookbook) o (2) eliminar (cookbooks) a través de un comando (knife cookbook) de borrado."
    }
  ],
  "lastModified": "2026-06-16T23:35:56.480",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opscode:chef:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "001059B9-0BBC-44B1-9B80-0252AFF77915",
              "versionEndIncluding": "0.9.16"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4303E45B-3CC7-4F86-9AA3-9DE9E340DDB7"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DE318AD-5737-453F-90B9-449A3593887E"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0FB009E-708B-41BE-98E3-0548204A594A"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C369798E-2499-4DD5-8C13-F7A3D0BCAED9"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E247C8C9-7404-4920-9CA8-91316483CF01"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0189B6A3-9D58-40D7-BB42-101A600B5014"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.7.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97B55226-BC34-4060-A37D-8317B8BFB43B"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E624C53F-1755-4E88-B575-1AB92781A06C"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAA73864-4852-47D9-9EB9-A2AD654D0BAC"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "112F8AEB-9DD0-4A68-B69C-B677BE373DAE"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C6B61EE-2F0D-49DC-ADFD-D0A25A21B8B6"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.8.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B91DE695-5740-4A14-AC39-873E69E5C69B"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2BBC6CA8-45FE-4A3E-8EA2-D4B3B2C8036C"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B0E4636-741A-488B-B630-069C31476987"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "870939E2-77E8-4821-851D-0B770B6BAD47"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5B26A9F-3A23-4828-80B5-D8B19AEC843B"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "802801AB-C583-4DCB-8542-D509C6E427B7"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "993E5C5C-C351-4B24-ABEB-AB43C364152B"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.12:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "571427BE-B823-414B-9553-D1F744FE24AE"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.9.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5A21EFF-2E01-4CD9-9710-328413910E58"
            },
            {
              "criteria": "cpe:2.3:a:opscode:chef:0.10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1F1938B-B09A-456A-B831-72A1BA7A76C2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}