CVE Feed

    Dashboard / CVE / CVE-2022-41400

    CVE-2022-41400

    Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings.

    Published:Apr 28, 2023
    Last Modified:Jan 30, 2025
    EPS:Apr 28, 2023
    EPSS Score:0.0007
    CVSS Score:9.8

    Affected Products

    Vendor
    Sage
    Product
    Sage 300

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2023-29927 (CVSS 4.3) — Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low…
    CVE-2022-41399 (CVSS 7.5) — The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PA…
    CVE-2022-41398 (CVSS 7.5) — The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for …
    CVE-2022-38583 (CVSS 7.8) — On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Cl…
    CVE-2022-41397 (CVSS 9.8) — The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte…
    CVE-2021-45492 (CVSS 7.8) — In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime director…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High