CVE-2025-8868 Chef Automate compliance service SQL Injection Vulnerability

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token...

CVE-2025-8868

Chef Automate is affected by CVE-2025-8868 for versions earlier than 4.13.295 on Linux x86. An authenticated attacker can access restricted functionality in the compliance service through SQL injection caused by improperly neutralized inputs using a well-known token. The NVD/NIST entry indicates ...

CVE-2025-6724 Chef Automate SQL Injection Vulnerability

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command...

CVE-2025-6724

CVE-2025-6724 affects Chef Automate on Linux x86, prior to 4.13.295, where an authenticated attacker can access restricted functionality in multiple services due to improperly neutralized inputs used in an SQL command. The root cause is input handling that enables SQL injection. Exploitation deta...

CVE-2025-6724 Chef Automate SQL Injection Vulnerability

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command...

PT-2025-39824

Name of the Vulnerable Software and Affected Versions Chef Automate versions prior to 4.13.295 Description An authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service. This is due to improperly neutralized inputs used in an SQL command utilizing a...

Chef Software Chef Automate SQL注入漏洞

Chef Software Chef Automate is an automation platform from Chef Software for automating and managing infrastructure, applications, and compliance to help organizations achieve continuous delivery, automated operations, and security compliance. A SQL injection vulnerability exists in Chef Software...

PT-2025-39823

Name of the Vulnerable Software and Affected Versions Chef Automate versions prior to 4.13.295 Description Chef Automate versions earlier than 4.13.295 on Linux x86 are susceptible to a condition where an authenticated attacker can access restricted functionality. This is due to improperly...

CVE-2025-6724: Improper Neutralization of Special Elements used in an SQL Command

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command...

CVE-2025-8868: Exposure of Sensitive Information to an Unauthorized Actor

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token...

Chef Automate 信息泄露漏洞

Chef Software Chef Automate is an automation platform from Chef Software for automating and managing infrastructure, applications, and compliance to help organizations achieve continuous delivery, automated operations, and security compliance. An information disclosure vulnerability exists in Che...

CVE-2023-40050

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

Remote code execution

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050 Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

CVE-2023-40050

CVE-2023-40050 affects Chef Automate versions prior to and including 4.10.29. A remote code execution flaw exists when uploading a profile through the API or the user interface using the InSpec check command with a maliciously crafted profile. Affected component is the profile upload pathway in C...

CVE-2023-40050: Improper Control of Generation of Code

Upload profile either through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec check command with maliciously crafted profile allows remote code execution...

PT-2023-27237 · Chef · Chef Automate

Name of the Vulnerable Software and Affected Versions: Chef Automate versions prior to and including 4.10.29 Description: The issue allows remote code execution when uploading a profile through the API or user interface in Chef Automate using the InSpec check command with a maliciously crafted...

Chef Automate Code Injection Vulnerability

Chef Software Chef Automate is an automation platform from Chef Software for automating and managing infrastructure, applications, and compliance to help organizations achieve continuous delivery, automated operations, and security compliance. A security vulnerability exists in Chef Automate...