PT-2025-39823 · Progress · Chef Automate

Published 2025-09-29 · Updated 2025-10-05 · CVE-2025-6724

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Chef Automate versions prior to 4.13.295

Description Chef Automate versions earlier than 4.13.295 on Linux x86 are susceptible to a condition where an authenticated attacker can access restricted functionality. This is due to improperly neutralized inputs used in an SQL command. The issue allows manipulation of inputs, potentially leading to unauthorized access.

Recommendations Update to version 4.13.295.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-13790

CVE-2025-6724

Affected Products

Chef Automate

References · 10

• https://docs.chef.io/release_notes_automate/#4.13.295 · Patch
• https://bdu.fstec.ru/vul/2025-13790 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6724 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6724 · Security Note
• https://t.me/CVEtracker/33624 · Telegram Post
• https://twitter.com/cracbot/status/1974429335017660684 · Twitter Post
• https://twitter.com/CVEnew/status/1972627041167032800 · Twitter Post
• https://reddit.com/r/devops/comments/1nyh9sm/cve20256724_chef_automate_sql_injection · Reddit Post
• https://twitter.com/CveFindCom/status/1972627406780354707 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1972644125129199698 · Twitter Post