CVE-2016-4326 : The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows r

The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.

Published 2016-06-10 01:59:07

Updated 2016-06-10 21:51:34

Source CERT/CC

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2016-4326

Chef » Chef Manage
Versions up to, including, (<=) 1.11.4
cpe:2.3:a:chef:chef_manage:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-4326

EPSS FAQ

0.81%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 80 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-4326

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2016-4326

http://www.kb.cert.org/vuls/id/586503

VU#586503 - Chef Manage deserializes cookie data insecurely
Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2016-4326

Products affected by CVE-2016-4326

Exploit prediction scoring system (EPSS) score for CVE-2016-4326

CVSS scores for CVE-2016-4326

References for CVE-2016-4326