VULNERABILITY INTELLIGENCE

CVE-2025-6724

CVSS score8.8 HIGH
EPSS probability0.38%
CISA KEVNot currently listed
Published2025-09-29
Last modified2026-10-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.

Weakness classification

  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Primary references