Vulnerability · Published Oct 4, 2023 · Assigned by INCIBE
CVE-2023-2809Use of Cleartext credentials in Sage 200 Spain
High 7.8
In plain English
A high-severity security flaw in Sage 200 Spain from Sage. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obtain remote execution of MS SQL commands and escalate privileges on Windows systems because the credentials are stored in plaintext.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sage | Sage 200 Spain | 2023.38.001 |
Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H