CVE-2017-3183

Sage XRT Treasury v3 is affected by CVE-2017-3183 through an authorization bypass where database access privileges are determined by the USER_CODE field. An authenticated, low-privilege user can alter USER_CODE to match a privileged user and gain full/privileged access to the SQL database, enabli...

Sage XRT Treasury database fails to properly restrict access to authorized users

Overview Sage XRT Treasury, version 3, fails to properly restrict database access to authorized users, which may enable any authenticated user to gain full access to privileged database functions. Description CWE-639: Authorization Bypass Through User-Controlled Key - CVE-2017-3183Sage XRT...