CVE-2023-2809CWE-312

Use of Cleartext credentials in Sage 200 Spain

High · published October 4, 2023

CVSS v3.1
7.8
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obtain remote execution of MS SQL commands and escalate privileges on Windows systems because the credentials are stored in plaintext.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2023-10-04T10:49Z
EPSS history
Timeline
  • 04 OCT 10:49Z
    Use of Cleartext credentials in Sage 200 Spain
    cvelistv5