Read the docs
TI-2022-18156 Aliases CVE-2022-38583GHSA-vc8j-g69q-pqfg

On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows…

Priority HIGH 69CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00258 17th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:*2017 – 2022VulnerableSage
  • cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:* Versions 2017 – 2022 Vulnerable ·Sage

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-38583
  2. 2026-10-03 Alias added: GHSA-vc8j-g69q-pqfg

References

Exploit 1

  • TI-2023-14078 Versions of Sage 300 through 2022 implement role-based access controls that are only… CVSS 3.1MEDIUM 4.3
  • TI-2022-19865 Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user… CVSS 3.1CRITICAL 9.8
  • TI-2022-19862 The optional Web Screens and Global Search features for Sage 300 through version 2022 use… CVSS 3.1CRITICAL 9.8
  • TI-2022-19864 The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded… CVSS 3.1HIGH 7.5
  • TI-2022-19863 The optional Global Search feature for Sage 300 through version 2022 uses a set of… CVSS 3.1HIGH 7.5
  • TI-2021-20579 In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences