CVE-2025-67807
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The login mechanism of Sage DPW 2025_06_004 returns distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.
Risk Assessment
An attacker can determine valid usernames, facilitating subsequent password attacks such as brute force or credential stuffing.
Recommendation
Upgrade Sage DPW to version 2021_06_000 or later and enable the option that normalizes login responses for on-premise administrators.
Other vulnerabilities in Sage DPW
See all- CVE-2025-67806Low
The login mechanism of Sage DPW 2021_06_004 returns distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behavior in newer versions.
- CVE-2025-67805Medium
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints in the Database Monitor feature, exposing sensitive information such as hashes and table names. The feature is disabled by default, never available in Sage DPW Cloud, and was forcibly disabled again in version 2025_06_003.
Original NVD description (English source)
The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumeration of existing accounts in versions before 2021_06_000. On-premise administrators can toggle this behaviour in newer versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS