CVE-2025-6724 describes a critical SQL injection vulnerability affecting Progress Chef Automate versions prior to 4.13.295 on Linux x86 platforms. An authenticated attacker can exploit improperly neutralized inputs to gain unauthorized access to restricted functionality across multiple services. With a CVSS score of 8.8 (High), this vulnerability allows for complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with low attack complexity and no user interaction required. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and the vulnerability is not listed in the KEV catalog, nor is there any community discussion or media coverage indicating active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 4.13.295CPE matchmatch criteria | cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:* | ||
>= 20180319150121, <= 20220329091442CPE matchmatch criteria | cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.