CVE-2023-40050 in Chef Automate

الملخص

بحسب MITRE • 31/10/2023

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• مسؤول: Progress Software Corporation
• حجز: 08/08/2023
• إفشاء: 31/10/2023
• الاعتدال: تمت الموافقة
• إدخال: VDB-244063
• CPE: جاهز
• CWE: CWE-94 (مؤكد)
• CVSS: 8.8 (NVD)
• EPSS: 0.01184
• KEV: لا
• النشاطات: منخفض جدًا
• القطاع: Telecommunication, Pharma, ...

المصادر

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-40050
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-40050
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-40050/