CVE-2025-8868: automate before 4.13.295 (exclusive), from 20180319150121 (inclusive), through 20220329091442 (inclusive); +1 more…

Affected technology

automate · before 4.13.295 (exclusive)
chef

automate · from 20180319150121 (inclusive), through 20220329091442 (inclusive)
chef

Chef Automate · 0 to before 4.13.295
Progress Software

Component: API-Token, compliance-service

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token. Vendor/CNA’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 8.8/10) rates confidentiality, integrity and availability impact as high.