PT-2023-22481 · Sage · Sage 300

Konrad Haase · Published 2023-05-16 · Updated 2023-05-25 · CVE-2023-29927

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sage 300 versions through 2022

Description The issue arises from the client-side enforcement of role-based access controls in Sage 300. This allows low-privileged users, especially those in specific network configurations, to recover SQL connection strings and directly interact with the database. This interaction enables them to create, update, and delete company records, effectively bypassing the program's access controls.

Recommendations For Sage 300 versions through 2022, consider restricting direct database access to mitigate the risk of unauthorized data modification until a patch is available. As a temporary workaround, limit the use of SQL connection strings within the application to prevent low-privileged users from exploiting this issue.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-29927

Affected Products

Sage 300

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-29927 · Security Note
• https://osv.dev/vulnerability/CVE-2023-29927 · Vendor Advisory
• https://controlgap.com/blog/critical-vulnerability-disclosure-sage-300 · Note
• https://t.me/cibsecurity/64267 · Telegram Post