{"id":"CVE-2025-8868","published":"2025-09-29T11:29:50Z","modified":"2025-09-29T12:55:02Z","title":"Chef Automate compliance service SQL Injection Vulnerability","vendor":"Progress Software","product":"Chef Automate","tier":"core","eol":null,"affectedVersions":[{"vendor":"Progress Software","product":"Chef Automate","versions":["< 4.13.295"]}],"description":{"text":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via \n\nimproperly neutralized inputs used in an SQL command using a well-known token.","provenance":"source","from":"CVE.org"},"summary":{"text":"Progress Chef Automate's compliance service contains an SQL injection flaw, arising from improperly neutralized inputs used in an SQL command, affecting versions earlier than 4.13.295 on Linux x86. An attacker with network access and authentication, using a well-known token, can reach restricted functionality in the compliance service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-11-01T01:03:32Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.25948,"percentile":0.97983,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-16","exploitedFirstSeen":"2025-10-16","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-8868","date":"2025-10-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-14&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-17&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-18&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-19&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-21&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-26&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-07&host_type=src&vulnerability=cve-2025-8868","date":"2025-12-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-08&host_type=src&vulnerability=cve-2025-8868","date":"2025-12-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-09&host_type=src&vulnerability=cve-2025-8868","date":"2025-12-09"}],"evidenceTotal":148,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://docs.chef.io/release_notes_automate/#4.13.295","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-31570","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31570","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-8868","name":"Chef Automate < 4.13.295 — SQL Injection","severity":"critical","path":"http/cves/2025/CVE-2025-8868.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8868.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-09-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-8868","provenance":"source"},{"date":"2025-10-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-8868","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 381 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.6,"detail":"percentile 0.9798"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}