VULNERABILITY INTELLIGENCE

CVE-2011-5098

CVSS score6.5 MEDIUM
EPSS probability1.68%
CISA KEVNot currently listed
Published2012-08-08
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:P/A:P

Description

chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.

Primary references