PT-2023-22481 · Sage · Sage 300

Konrad Haase · Publicado 2023-05-16 · Atualizado 2023-05-25 · CVE-2023-29927

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sage 300 versions through 2022

Description The issue arises from the client-side enforcement of role-based access controls in Sage 300. This allows low-privileged users, especially those in specific network configurations, to recover SQL connection strings and directly interact with the database. This interaction enables them to create, update, and delete company records, effectively bypassing the program's access controls.

Recommendations For Sage 300 versions through 2022, consider restricting direct database access to mitigate the risk of unauthorized data modification until a patch is available. As a temporary workaround, limit the use of SQL connection strings within the application to prevent low-privileged users from exploiting this issue.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-29927

Produtos afetados

Sage 300

Referências · 4

• https://controlgap.com/blog/critical-vulnerability-disclosure-sage-300 · Nota
• https://t.me/cibsecurity/64267 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-29927 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-29927 · Aviso do Fabricante