CVE

Id
53009  
CVE No.
CVE-2011-5097  
Status
Candidate  
Description
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command.  
Phase
Assigned (20120808)  
Votes
None (candidate not yet proposed)  
Comments