PT-2023-13977 · Sage · Sage 300

Published 2023-04-28 · Updated 2025-01-31 · CVE-2022-41397

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sage 300 versions through 2022

Description The issue concerns the use of a hard-coded 40-byte blowfish key, specifically LandlordPassKey, for encrypting and decrypting secrets stored in configuration files and database tables. This is related to the optional Web Screens and Global Search features.

Recommendations For Sage 300 versions through 2022, consider disabling the Web Screens and Global Search features until a patch is available to mitigate the risk associated with the hard-coded blowfish key. Restrict access to configuration files and database tables to minimize the risk of exploitation. Avoid using the LandlordPassKey for any encryption or decryption processes in the affected features.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-41397

Affected Products

Sage 300

References · 6

• https://osv.dev/vulnerability/CVE-2022-41397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41397 · Security Note
• https://t.me/cvenotify/109499 · Telegram Post
• https://t.me/cibsecurity/63040 · Telegram Post
• https://sage.com/en-ca/products/sage-300 · Note
• https://t.me/cvenotify/49303 · Telegram Post