VYPR
← All advisories
Moderate severityNVD Advisory· Published Aug 8, 2012· Updated Apr 29, 2026

CVE-2010-5142

CVE-2010-5142

Description

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
chefRubyGems
< 0.9.00.9.0

Affected products

12
  • Opscode/Chef12 versions
    cpe:2.3:a:opscode:chef:*:*:*:*:*:*:*:*+ 11 more
    • cpe:2.3:a:opscode:chef:*:*:*:*:*:*:*:*range: <=0.8.10
    • cpe:2.3:a:opscode:chef:0.7.10:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.7.12:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.7.14:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.7.2:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.7.4:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.7.6:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.7.8:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.8.2:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.8.4:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.8.6:*:*:*:*:*:*:*
    • cpe:2.3:a:opscode:chef:0.8.8:*:*:*:*:*:*:*

Patches

1
c3bb41f727fb

CHEF-1289 API does not check for admin rights for user management

https://github.com/opscode/chefIan MeyerJun 10, 2010via ghsa
commit
1 file changed · +1 −0
  • chef-server-api/app/controllers/users.rb+1 −0 modified
    @@ -22,6 +22,7 @@ class Users < Application
   provides :json
 
   before :authenticate_every
+  before :is_admin, :only => [ :create, :destroy, :update ]
 
   # GET to /users
   def index

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.