Approved changes feed: RSS · Atom
cpe:2.3:a:chef:automate:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Chef (c00de2d4-178c-5fd2-938c-b22719db34b3) |
|---|---|
| Product | Automate (3803421f-a09f-5053-92a3-9f72104f9887) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/chef/automate |
purl2cpe | 2026-06-01 10:11:02.799191 |
pkg:golang/github.com/chef/automate |
purl2cpe | 2026-06-01 10:11:02.799194 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-8868 |
vulnerable | 2026-06-08 07:45:21.331788 |
Chef Automate compliance service SQL Injection Vulnerability
CRITICAL (9.8)
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in the compliance service via
improperly neutralized inputs used in an SQL command using a well-known token.
Published: 2025-09-29T11:29:50.463Z
Updated: 2025-09-29T12:55:02.884Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-6724 |
vulnerable | 2026-06-08 07:43:16.135791 |
Chef Automate SQL Injection Vulnerability
HIGH (8.8)
In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.
Published: 2025-09-29T11:29:42.695Z
Updated: 2025-09-29T13:02:01.775Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-40050 |
vulnerable | 2026-06-08 06:09:41.118955 |
Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application
CRITICAL (9.9)
Upload profile either
through API or user interface in Chef Automate prior to and including version 4.10.29 using InSpec
check command with maliciously crafted profile allows remote code execution.
Published: 2023-10-31T14:07:59.881Z
Updated: 2024-09-06T15:41:14.418Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.