CVE Feed

    Dashboard / CVE / CVE-2022-41398

    CVE-2022-41398

    The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information.

    Published:Apr 28, 2023
    Last Modified:Jan 31, 2025
    EPS:Apr 28, 2023
    EPSS Score:0.00069
    CVSS Score:7.5

    Affected Products

    Vendor
    Sage
    Product
    Sage 300

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2023-29927 (CVSS 4.3) — Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low…
    CVE-2022-41399 (CVSS 7.5) — The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PA…
    CVE-2022-41400 (CVSS 9.8) — Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL con…
    CVE-2022-38583 (CVSS 7.8) — On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Cl…
    CVE-2022-41397 (CVSS 9.8) — The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte…
    CVE-2021-45492 (CVSS 7.8) — In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime director…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High