{"id":"CVE-2025-8868","published":"2025-09-29T11:29:50Z","modified":"2025-09-29T12:55:02Z","title":"Chef Automate compliance service SQL Injection Vulnerability","vendor":"Progress Software","product":"Chef Automate","tier":"core","eol":null,"affectedVersions":[{"vendor":"Progress Software","product":"Chef Automate","versions":["< 4.13.295"]}],"description":{"text":"In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via \n\nimproperly neutralized inputs used in an SQL command using a well-known token.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.25948,"percentile":0.97977,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-10-16","exploitedFirstSeen":"2025-10-16","ransomware":false,"evidence":[{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-8868","date":"2025-10-16"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-14&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-17&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-18&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-19&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-21&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-11-26&host_type=src&vulnerability=cve-2025-8868","date":"2025-11-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-07&host_type=src&vulnerability=cve-2025-8868","date":"2025-12-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-08&host_type=src&vulnerability=cve-2025-8868","date":"2025-12-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-12-09&host_type=src&vulnerability=cve-2025-8868","date":"2025-12-09"}],"evidenceTotal":148,"provenance":"source"},"exploited":true,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"},{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"https://docs.chef.io/release_notes_automate/#4.13.295","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-31570","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31570","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2025-8868","name":"Chef Automate < 4.13.295 — SQL Injection","severity":"critical","path":"http/cves/2025/CVE-2025-8868.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-8868.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-09-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-8868","provenance":"source"},{"date":"2025-10-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-8868","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 379 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.6,"detail":"percentile 0.9798"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}