Vulnerabilities > Sage > Sage 300 > High

DATE CVE VULNERABILITY TITLE RISK
2023-04-28 CVE-2022-38583 Incorrect Default Permissions vulnerability in Sage 300 2020/2021/2022
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator.
local
low complexity
sage CWE-276
7.8
2023-04-28 CVE-2022-41398 Use of Hard-coded Credentials vulnerability in Sage 300 2020/2021/2022
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance.
network
low complexity
sage CWE-798
7.5
2023-04-28 CVE-2022-41399 Use of Hard-coded Credentials vulnerability in Sage 300 2020/2021/2022
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml".
network
low complexity
sage CWE-798
7.5
2022-07-14 CVE-2021-45492 Incorrect Permission Assignment for Critical Resource vulnerability in Sage 300
In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable.
local
low complexity
sage CWE-732
7.8