CVE Feed

    Dashboard / CVE / CVE-2022-41399

    CVE-2022-41399

    The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database.

    Published:Apr 28, 2023
    Last Modified:Jan 31, 2025
    EPS:Apr 28, 2023
    EPSS Score:0.00069
    CVSS Score:7.5

    Affected Products

    Vendor
    Sage
    Product
    Sage 300

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2023-29927 (CVSS 4.3) — Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low…
    CVE-2022-41400 (CVSS 9.8) — Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL con…
    CVE-2022-41398 (CVSS 7.5) — The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for …
    CVE-2022-38583 (CVSS 7.8) — On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Cl…
    CVE-2022-41397 (CVSS 9.8) — The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte…
    CVE-2021-45492 (CVSS 7.8) — In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime director…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High