Skip to content
OpenAdvisories
High · 8.8 CVE-2025-6724 EUVD-2025-31571GHSA-hj5c-r9rg-h7g3

Chef Automate SQL Injection Vulnerability

Published Sep 29, 2025 · Updated Sep 29, 2025 · Assigned by ProgressSoftware

Description

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.

Affected products

VendorProductAffectedFixed
Progress Software Chef Automate < 4.13.295 4.13.295

References