Critical severity9.9NVD Advisory· Published Oct 31, 2023· Updated Jun 17, 2026

CVE-2023-40050

Description

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Chef/Automate2 versions
cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*range: <=4.10.29
- (no CPE)range: <=4.10.29
Progress (organisation)/Chef Automatecpe-rescue
Range: 4.0.0

Patches

Vulnerability mechanics

References

community.progress.com/s/article/Product-Alert-Bulletin-October-2023-CHEF-Automate-CVE-2023-40050nvdVendor Advisory
docs.chef.io/automate/profiles/nvdProduct
docs.chef.io/release_notes_automate/nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.643
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000