CVE-2025-8868
CRITICAL EXPLOITED NUCLEIChef Automate < 4.13.295 - Information Disclosure
Title source: ruleDescription
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via improperly neutralized inputs used in an SQL command using a well-known token.
Nuclei Templates (1)
Chef Automate < 4.13.295 — SQL Injection
CRITICALVERIFIEDby 3th1c_yuk1,xbow
FOFA:
body="Chef Automate"
Scores
CVSS v3
9.8
EPSS
0.1726
EPSS Percentile
95.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2025-10-16
CWE
CWE-200
CWE-89
Status
published
Products (1)
chef/automate
< 4.13.295
Published
Sep 29, 2025
Tracked Since
Feb 18, 2026