CVE-2022-38583

On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://sage.com	Vendor Advisory
https://www.controlgap.com/blog/sage-300-case-study	Exploit Third Party Advisory
http://sage.com	Vendor Advisory
https://www.controlgap.com/blog/sage-300-case-study	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:*

History

21 Nov 2024, 07:16

Type	Values Removed	Values Added
References	~~() http://sage.com - Vendor Advisory~~	() http://sage.com - Vendor Advisory
References	~~() https://www.controlgap.com/blog/sage-300-case-study - Exploit, Third Party Advisory~~	() https://www.controlgap.com/blog/sage-300-case-study - Exploit, Third Party Advisory

Information

Published : 2023-04-28 13:15

Updated : 2024-11-21 07:16

NVD link : CVE-2022-38583

Mitre link : CVE-2022-38583

CVE.ORG link : CVE-2022-38583

JSON object : View

Products Affected

sage

sage_300

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2022-38583", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-04-28T13:15:13.313", "references": [{"url": "http://sage.com", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.controlgap.com/blog/sage-300-case-study", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://sage.com", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.controlgap.com/blog/sage-300-case-study", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a \"Windows Peer-to-Peer Network\" or \"Client Server Network\" configuration, a low-privileged Sage 300 workstation user could abuse their access to the \"SharedData\" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server."}], "lastModified": "2024-11-21T07:16:42.400", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A29C9EFF-0209-4D1D-97EA-22B0DE2BF56B", "versionEndIncluding": "2022", "versionStartIncluding": "2017"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}