Database Connection String Vulnerability in Sage 300 by Sage
CVE-2022-41399

7.5HIGH

Key Information:

Vendor

Sage

Status
Sage 300
Vendor
CVE Published:
28 April 2023

What is CVE-2022-41399?

The Web Screens feature of Sage 300, up until version 2022, is affected by a security flaw where a hard-coded 40-byte blowfish key, known as 'PASS_KEY', is utilized to encrypt and decrypt the database connection string contained in the 'dbconfig.xml' file. This vulnerability may allow unauthorized attackers to gain access to the PORTAL database, potentially compromising sensitive information and leading to unauthorized actions against data integrity.

References

https://www.sage.com/en-ca/products/sage-300/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.