CVE-2022-41399: Sage 300

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers to obtain access to the SQL database.

Affected products

• Sage Sage 300: up to and including 2022

Published 2023-04-28. Last modified 2026-06-17.