CVE-2022-38583 is a critical vulnerability affecting Sage 300 versions 2017-2022 (6.4.x-6.9.x) in peer-to-peer or client-server configurations. A low-privileged user can exploit this to access and modify credentials in the "SharedData" folder, leading to impersonation of users and SQL database administrators. This allows for full control over Sage 300 data and potential code execution on the database server, with a CVSS score of 7.8 (HIGH). There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2017, <= 2022CPE matchmatch criteria | cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.