8.8High
CVE-2025-6724Chef Automate SQL Injection Vulnerability
Description
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.
Weakness (CWE):
CWE-89
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| chef | automate | < 4.13.295 | |
| Progress Software | Chef Automate | < 4.13.295 |
References and patches
CPE matches (NVD) (2)
cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*< 4.13.295cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*≥ 20180319150121 ≤ 20220329091442