9.8Kritisch
CVE-2025-8868Chef Automate compliance service SQL Injection Vulnerability
Beschreibung
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| chef | automate | < 4.13.295 | |
| Progress Software | Chef Automate | < 4.13.295 |
Referenzen und Patches
CPE-Treffer (NVD) (2)
cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*< 4.13.295cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*≥ 20180319150121 ≤ 20220329091442