CVE-2023-40050 in Chef Automate

Sumário

de MITRE • 31/10/2023

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Responsável: Progress Software Corporation
• Reservar: 08/08/2023
• Divulgação: 31/10/2023
• Moderação: aceite
• Entrada: VDB-244063
• CPE: pronto
• CWE: CWE-94 (confirmado)
• CVSS: 8.8 (NVD)
• EPSS: 0.01184
• KEV: não
• Atividades: muito baixo
• Sector: Telecommunication, Pharma, ...

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2023-40050
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2023-40050
• CVE Details: https://www.cvedetails.com/cve/CVE-2023-40050/