Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings.
References
| Link | Resource |
|---|---|
| https://www.sage.com/en-ca/products/sage-300/ | Product |
| https://www.sage.com/en-ca/products/sage-300/ | Product |
Configurations
History
21 Nov 2024, 07:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.sage.com/en-ca/products/sage-300/ - Product |
05 May 2023, 18:03
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-798 | |
| References | (MISC) https://www.sage.com/en-ca/products/sage-300/ - Product | |
| CPE | cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| First Time |
Sage sage 300
Sage |
28 Apr 2023, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-28 13:15
Updated : 2025-01-30 21:15
NVD link : CVE-2022-41400
Mitre link : CVE-2022-41400
CVE.ORG link : CVE-2022-41400
JSON object : View
Products Affected
sage
- sage_300
CWE
CWE-798
Use of Hard-coded Credentials