CoreCVE
Back

HIGH

The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml"

Published Apr 28, 2023

Description

The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 28, 2023
Updated Jan 31, 2025
Reserved Sep 26, 2022
Link CVE-2022-41399
CISA Vulnrichment
Updated Jan 31, 2025
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2022-41399
Red Hat
Severity n/a
Public date n/a
Links CVE-2022-41399