GCVE - cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Sage (`c8b89926-672a-55fd-8b90-8159b08c65cc`)
Product	Sage 300 (`af5d19b3-5c5e-500c-b819-062be5ba3201`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-29927`	vulnerable	2026-06-08 06:02:40.774563	Details available Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls. Published: 2023-05-16T00:00:00.000Z Updated: 2025-01-23T16:25:25.279Z Open on db.gcve.eu Reference links https://www.controlgap.com/blog/critical-vulnerability-disclosure-sage-300	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41400`	vulnerable	2026-06-08 05:48:30.359472	Details available Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connection strings. Published: 2023-04-28T00:00:00.000Z Updated: 2025-01-30T20:35:22.232Z Open on db.gcve.eu Reference links https://www.sage.com/en-ca/products/sage-300/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41399`	vulnerable	2026-06-08 05:48:30.359177	Details available The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database. Published: 2023-04-28T00:00:00.000Z Updated: 2025-01-31T16:45:01.913Z Open on db.gcve.eu Reference links https://www.sage.com/en-ca/products/sage-300/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41398`	vulnerable	2026-06-08 05:48:30.358846	Details available The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive information. Published: 2023-04-28T00:00:00.000Z Updated: 2025-01-31T16:45:53.984Z Open on db.gcve.eu Reference links https://www.sage.com/en-ca/products/sage-300/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-41397`	vulnerable	2026-06-08 05:48:30.358431	Details available The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration files and in database tables. Published: 2023-04-28T00:00:00.000Z Updated: 2025-01-31T17:52:54.175Z Open on db.gcve.eu Reference links https://www.sage.com/en-ca/products/sage-300/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-38583`	vulnerable	2026-06-08 05:47:16.683553	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-45492`	vulnerable	2026-06-08 05:36:48.252812	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.