PT-2025-39824 · Progress · Chef Automate

Published 2025-09-29 · Updated 2025-10-07 · CVE-2025-8868

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chef Automate versions prior to 4.13.295

Description An authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service. This is due to improperly neutralized inputs used in an SQL command utilizing a well-known token. The issue allows bypassing of restrictions within the compliance service.

Recommendations Update Chef Automate to version 4.13.295 or later.

Fix

Information Disclosure

SQL injection

Weakness Enumeration

CWE-200

CWE-89

Related Identifiers

CVE-2025-8868

Affected Products

Chef Automate

References · 11

• https://docs.chef.io/release_notes_automate/#4.13.295 · Patch
• https://osv.dev/vulnerability/CVE-2025-8868 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8868 · Security Note
• https://twitter.com/CveFindCom/status/1972627371464228878 · Twitter Post
• https://twitter.com/0dayPublishing/status/1972627094174593520 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1975561789342687409 · Twitter Post
• https://twitter.com/CVEnew/status/1972627040009380213 · Twitter Post
• https://twitter.com/cracbot/status/1974429336712118662 · Twitter Post
• https://t.me/CVEtracker/33625 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1972646410110599667 · Twitter Post
• https://twitter.com/Xbow/status/1973028047545872721 · Twitter Post