CVE-2025-67805: Infoleak
A non-default configuration in Sage DPW 202506004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information such as hashes and table names. This feature is disabled by default in all installations and never available in Sage DPW Cloud. It was forcibly disabled again in version 202506003.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67805?
CVE-2025-67805 has been classified with a moderate severity rating due to the potential exposure of sensitive information.
How do I fix CVE-2025-67805?
To mitigate CVE-2025-67805, ensure that the diagnostic endpoints in the Database Monitor feature are disabled and not accessible to unauthenticated users.
What information is exposed in CVE-2025-67805?
CVE-2025-67805 allows access to sensitive information including hashes and table names through unauthenticated access.
Is CVE-2025-67805 present in all installations of Sage DPW?
CVE-2025-67805 is present only in installations of Sage DPW 2025_06_004 where the feature is incorrectly configured.
Is CVE-2025-67805 applicable to Sage DPW Cloud?
No, CVE-2025-67805 is not applicable to Sage DPW Cloud as the Database Monitor feature is not available.