LiveActive security incident?Get immediate response
CVE Record

CVE-2023-28864: Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cac...

Progress Chef Infra Server before 15.7 allows a local attacker to exploit a /var/opt/opscode/local-mode-cache/backup world-readable temporary backup path to access sensitive information, resulting in the disclosure of all indexed node data, because OpenSearch credentials are exposed. (The data typically includes credentials for additional systems.) The attacker must wait for an admin to run the "chef-server-ctl reconfigure" command.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2023-28864 exposes sensitive Chef Infra Server data to a local user during server reconfiguration. The issue can reveal OpenSearch credentials and indexed node data, which may include credentials for other systems. It affects Chef Infra Server before 15.7.

Executive priority

Prioritize remediation where Chef Infra Server manages production infrastructure or stores credentials for downstream systems. Local access limits scale, but credential disclosure can create broader business impact.

Technical view

Progress Chef Infra Server before 15.7 uses a world-readable temporary backup path under its local-mode cache. During administrator-triggered reconfiguration, a local attacker may read exposed OpenSearch credentials and access indexed node data. Public sources do not provide CVSS details or evidence of active exploitation.

Likely exposure

Exposure is limited to Chef Infra Server hosts running versions before 15.7 where untrusted or compromised local users exist. Impact may extend beyond the Chef server if indexed node data contains downstream credentials.

Exploitation context

The attacker needs local access and must wait for an administrator reconfiguration event. The CVE is not listed as KEV in the provided bundle, and no cited source supports active exploitation.

Researcher notes

The core weakness is sensitive data exposure through permissive temporary backup permissions during reconfiguration. Evidence supports the affected version boundary and data disclosure path, but public scoring, CWE mapping, and exploitation telemetry are incomplete in the provided bundle.

Mitigation direction

  • Upgrade Chef Infra Server to version 15.7 or later.
  • Follow Progress Chef release notes and vendor remediation guidance.
  • Limit local shell access on Chef Infra Server systems.
  • Rotate credentials if indexed node data may have been exposed.

Validation and detection

  • Inventory Chef Infra Server versions and identify hosts below 15.7.
  • Review local user access on affected Chef server hosts.
  • Confirm temporary backup paths are not world-readable after remediation.
  • Assess whether exposed indexed node data contained reusable credentials.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-28864 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
4Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.