CVE-2022-38583: High severity Sage Sage 300 vulnerability
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-38583?
CVE-2022-38583 is a vulnerability found in versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) that allows a low-privileged user to view and modify the SharedData folder on the connected Sage 300 server.
How does CVE-2022-38583 affect Sage 300?
CVE-2022-38583 affects Sage 300 2017 - 2022 (6.4.x - 6.9.x) when it is set up in a Windows Peer-to-Peer Network or Client Server Network configuration.
What is the severity of CVE-2022-38583?
CVE-2022-38583 has a severity rating of 7.8 (High).
How can a low-privileged user exploit CVE-2022-38583?
A low-privileged user can abuse their access to the SharedData folder on the connected Sage 300 server to view and modify the data.
Is there a fix for CVE-2022-38583?
Yes, a fix for CVE-2022-38583 is available. It is recommended to update to a patched version of Sage 300 to address this vulnerability.