Skip to content
CVE Tracker
Back

CVE-2017-3183

Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions

High8.8EPSS 2.1%
Published
Updated
Reserved
Assigned by
certcc

Description

Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Sage XRT Treasury is a business finance management application. Database user access privileges are determined by the USER_CODE field associated with the querying user. By modifying the USER_CODE value to match that of a privileged user, a low-privileged, authenticated user may gain privileged access to the SQL database. A remote, authenticated user can submit specially crafted SQL queries to gain privileged access to the application database.

Scores

CVSS scores of CVE-2017-3183, by who scored it
Scored byCVSSScoreVector
NVDNVD · Modified3.0High8.8CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
2.1% · top 18% of all CVEs (2 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

Affected products

  • Sage · XRT Treasury

    • affected 3

What to do

Solution: The vendor has indicated that XRT Treasury version 4 addresses this issue. Users are encouraged to update to the latest release and to encrypt connections to the database server.

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .