CVE-2022-38583
Last modified
CVE-2022-38583 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sage | Sage 300 | >= 2017, <= 2022 |
References
- https://www.controlgap.com/blog/sage-300-case-studyExploit, Third Party Advisory
- https://www.controlgap.com/blog/sage-300-case-studyExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-38583?
How severe is CVE-2022-38583?
How do I fix CVE-2022-38583?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-3857310-Strike Network Inventory Explorer v9.3 was discovered to …9.8
- CVE-2022-38576Interview Management System v1.0 was discovered to contain a…7.2
- CVE-2022-38577ProcessMaker before v3.5.4 was discovered to contain insecur…8.8
- CVE-2022-3858The Floating Chat Widget: Contact Chat Icons, Telegram Chat,…7.2
- CVE-2022-38580Zalando Skipper v0.13.236 is vulnerable to Server-Side Reque…9.8
- CVE-2022-38582Incorrect access control in the anti-virus driver wsdkd.sys …6.5
- CVE-2022-3859An uncontrolled search path vulnerability exists in Trellix …6.7
- CVE-2022-38594Church Management System v1.0 was discovered to contain a SQ…7.2
- CVE-2022-38595Church Management System v1.0 was discovered to contain a SQ…7.2
- CVE-2022-38599Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2…6.5
- CVE-2022-3860The Visual Email Designer for WooCommerce WordPress plugin b…8.8
- CVE-2022-38600Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via v…5.5
Are you affected by CVE-2022-38583?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST