CVE-2023-29927: Medium severity sage 300 vulnerability
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-29927?
CVE-2023-29927 is a vulnerability found in versions of Sage 300 through 2022.
What is the severity of CVE-2023-29927?
The severity of CVE-2023-29927 is medium with a CVSS score of 4.3.
How does CVE-2023-29927 impact Sage 300 users?
CVE-2023-29927 enables low-privileged Sage users, particularly those in specific network configurations, to recover the SQL connection strings used by Sage 300.
Which versions of Sage 300 are affected by CVE-2023-29927?
Versions of Sage 300 through 2022 are affected by CVE-2023-29927.
How can I mitigate the CVE-2023-29927 vulnerability in Sage 300?
To mitigate the CVE-2023-29927 vulnerability in Sage 300, it is recommended to update to a fixed version when available and implement additional security controls such as network segmentation and access monitoring.