CVE-2023-28864

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command.

• CWE-922

• https://blog.mondoo.com/chef-infra-server-cve-2023-28864-impact-and-remediationMitigation, Third Party Advisory
• https://docs.chef.io/release_notes_server/Release Notes
• https://github.com/chef/chef-server/blob/8a2dc82148844767f7c7728633a03dcee812e56a/omnibus/files/server-ctl-cookbooks/infra-server/recipes/oc_bifrost.rb#L42Product
• https://blog.mondoo.com/chef-infra-server-cve-2023-28864-impact-and-remediationMitigation, Third Party Advisory
• https://docs.chef.io/release_notes_server/Release Notes
• https://github.com/chef/chef-server/blob/8a2dc82148844767f7c7728633a03dcee812e56a/omnibus/files/server-ctl-cookbooks/infra-server/recipes/oc_bifrost.rb#L42Product

Published

Jul 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28857Apereo CAS is an open source multilingual single sign-on sol…7.5
• CVE-2023-28858redis-py before 4.5.3 leaves a connection open after canceli…3.7
• CVE-2023-28859redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connec…6.5
• CVE-2023-2886Missing Origin Validation in WebSockets vulnerability in CBO…4.3
• CVE-2023-28862An issue was discovered in LemonLDAP::NG before 2.16.1. Weak…9.8
• CVE-2023-28863AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verifi…9.1
• CVE-2023-28865Diebold Nixdorf Vynamic Security Suite (VSS) before 3.3.0 SR…6.6
• CVE-2023-28866In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c …5.3
• CVE-2023-28867In GraphQL Java (aka graphql-java) before 20.1, an attacker …7.5
• CVE-2023-28868Support Assistant in NCP Secure Enterprise Client before 12.…8.1
• CVE-2023-28869Support Assistant in NCP Secure Enterprise Client before 12.…6.5
• CVE-2023-2887Authentication Bypass by Spoofing vulnerability in CBOT Chat…9.8