CVE-2022-41399: High severity sage 300 vulnerability
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASSKEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Sage 300 issue?
The vulnerability ID for this issue is CVE-2022-41399.
What is the impact of CVE-2022-41399?
CVE-2022-41399 could allow attackers to obtain access to the SQL database for Sage 300 through version 2022.
How does CVE-2022-41399 work?
CVE-2022-41399 occurs because the optional Web Screens feature for Sage 300 uses a hard-coded blowfish key to encrypt and decrypt the database connection string.
How can I fix CVE-2022-41399 in Sage 300?
To fix CVE-2022-41399, it is recommended to update to a version of Sage 300 that addresses this vulnerability.
Where can I find more information about Sage 300?
More information about Sage 300 can be found at the following link: [https://www.sage.com/en-ca/products/sage-300/](https://www.sage.com/en-ca/products/sage-300/)