Hard-Coded Credential Vulnerability in Sage 300 from Sage
CVE-2022-41398

7.5HIGH

Key Information:

Vendor

Sage

Status
Sage 300
Vendor
CVE Published:
28 April 2023

What is CVE-2022-41398?

The Global Search feature in Sage 300 up to version 2022 employs hard-coded credentials for its associated Apache Solr instance. This security lapse could empower attackers to gain unauthorized access to the Solr dashboard with administrative rights, potentially compromising sensitive data and undermining the integrity of the entire system.

References

https://www.sage.com/en-ca/products/sage-300/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.