CVE-2022-38583 - CVE House
Back to Database
Status published Unknown CVE-2022-38583

On versions of Sage 300 2017 - 2022 (6.4.x -...

Vulnerability Description

On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-38583

Credits & Attribution

No credits recorded in the NVD database.

References

More from sage

View All →
CVE-2022-41400
Sage 300 through 2022 uses a hard-coded 40-byte blowfish key...
Unknown 0
CVE-2022-41399
The optional Web Screens feature for Sage 300 through version...
Unknown 0
CVE-2022-41398
The optional Global Search feature for Sage 300 through version...
Unknown 0
CVE-2022-41397
The optional Web Screens and Global Search features for Sage...
Unknown 0
CVE-2022-34324
Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow...
Unknown 0

Affected Vendor

Affected Software

sage 300
Vulnerable Versions:
2017

Timeline

Official Publish: April 28th, 2023
Last Modified: July 9th, 2026
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.