CVE-2023-28864

CVE-2023-28864 is a local privilege escalation vulnerability affecting Progress Chef Infra Server versions prior to 15.7. A local attacker can exploit a world-readable temporary backup path to access sensitive OpenSearch credentials, leading to the disclosure of all indexed node data, which often includes credentials for other systems. This medium-severity vulnerability (CVSS 5.5) requires an administrator to execute "chef-server-ctl reconfigure" for exploitation. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.