CVE-2025-67805
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints in the Database Monitor feature, exposing sensitive information such as hashes and table names. The feature is disabled by default, never available in Sage DPW Cloud, and was forcibly disabled again in version 2025_06_003.
Risk Assessment
An unauthenticated attacker can obtain database structure and hash information, facilitating further attacks against the system.
Recommendation
Ensure the Database Monitor feature is disabled; if it was enabled, review access logs and rotate any exposed credentials.
Other vulnerabilities in Sage DPW
See all- CVE-2025-67807Medium
The login mechanism of Sage DPW 2025_06_004 returns distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.
- CVE-2025-67806Low
The login mechanism of Sage DPW 2021_06_004 returns distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.
Original NVD description (English source)
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information such as hashes and table names. This feature is disabled by default in all installations and never available in Sage DPW Cloud. It was forcibly disabled again in version 2025_06_003.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS