Ubuntu.comUB:CVE-2023-28864CVE-2023-28864
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
5.1%
Progress Chef Infra Server before 15.7 allows a local attacker to exploit a
/var/opt/opscode/local-mode-cache/backup world-readable temporary backup
path to access sensitive information, resulting in the disclosure of all
indexed node data, because OpenSearch credentials are exposed. (The data
typically includes credentials for additional systems.) The attacker must
wait for an admin to run the “chef-server-ctl reconfigure” command.
References
blog.mondoo.com/chef-infra-server-cve-2023-28864-impact-and-remediation
docs.chef.io/release_notes_server/
github.com/chef/chef-server/blob/8a2dc82148844767f7c7728633a03dcee812e56a/omnibus/files/server-ctl-cookbooks/infra-server/recipes/oc_bifrost.rb#L42
launchpad.net/bugs/cve/CVE-2023-28864
nvd.nist.gov/vuln/detail/CVE-2023-28864
security-tracker.debian.org/tracker/CVE-2023-28864
www.cve.org/CVERecord?id=CVE-2023-28864
Related
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
5.1%