CVE-2011-5097

Severity: medium (CVSS 5.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-08-08 · updated 2026-06-16
Weakness: CWE-264

Description

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command.

Affected products

Opscode Chef: through 0.9.16; 0.7.2, 0.7.4, 0.7.6, 0.7.8, 0.7.10, 0.7.12 (+15)

References

http://tickets.opscode.com/browse/CHEF-2436
https://github.com/opscode/chef/commit/a4ea6edab2fecb922f999cffb0daa04eeeec7a26
http://tickets.opscode.com/browse/CHEF-2436
https://github.com/opscode/chef/commit/a4ea6edab2fecb922f999cffb0daa04eeeec7a26

Get alerted when CVE-2011-5097 or the next vulnerability affects your stack