CVE-2022-41400: Critical severity sage 300 vulnerability
Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-41400?
CVE-2022-41400 is a vulnerability in Sage 300 through 2022 that uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files.
How does CVE-2022-41400 impact Sage 300?
CVE-2022-41400 allows attackers to decrypt user passwords and SQL connection strings, potentially compromising the security of Sage 300.
What is the severity level of CVE-2022-41400?
CVE-2022-41400 has a severity level of 9.8 (critical).
How can I fix CVE-2022-41400?
To fix CVE-2022-41400, it is recommended to update Sage 300 to the latest version, which addresses the vulnerability.
Where can I find more information about Sage 300?
More information about Sage 300 can be found at the official Sage website: https://www.sage.com/en-ca/products/sage-300/