Security readout for executives and security teams
Plain-English summary
A diagnostic feature in the self-hosted Sage DPW product can leak sensitive database details, such as password hashes and table names, to anyone on the network if an administrator turned it on. The feature is off by default and is never present in the cloud version, so most customers are not impacted unless they explicitly enabled it.
Executive priority
Medium priority. Limited to self-hosted Sage DPW where the optional Database Monitor was deliberately enabled. Cloud customers are unaffected. Verify configuration on on-prem systems.
Technical view
CVE-2025-67805 is a CWE-200 information exposure in Sage DPW 2025_06_004 where a non-default Database Monitor configuration exposes unauthenticated diagnostic endpoints. Successful reach yields sensitive material including credential hashes and table names. CVSS 3.1 scores 5.9 (AV:N/AC:H/PR:N/UI:N/C:H/I:N/A:N). The feature is disabled by default, absent in Sage DPW Cloud, and was forcibly disabled again in version 2025_06_003.
Likely exposure
Affects only self-hosted Sage DPW installations where an administrator enabled the Database Monitor feature, which ships disabled. Sage DPW Cloud tenants are not exposed. Internet-facing deployments with the feature toggled on face the greatest risk.
Exploitation context
No public reports of exploitation and not listed in CISA KEV. Attack requires the diagnostic feature to be turned on and reachable over the network. CVSS attack complexity is high, reflecting non-default conditions, but no authentication is needed once exposed.
Researcher notes
CVSS 5.9 with AC:H reflects the non-default configuration prerequisite. Impact is confidentiality-only (C:H/I:N/A:N) via CWE-200 information exposure in the Database Monitor diagnostic endpoints. The advisory states the feature was forcibly disabled again in 2025_06_003, suggesting a regression or re-enablement path is what the fix closes. Affected product metadata is not enumerated in the CVE record beyond Sage DPW 2025_06_004.
Mitigation direction
- Confirm the Database Monitor feature is disabled on all self-hosted Sage DPW environments.
- Upgrade to a Sage DPW build that forcibly disables the diagnostic endpoints, per vendor guidance.
- Restrict network access to administrative and diagnostic paths using firewall or reverse-proxy allowlists.
- Rotate any database credentials whose hashes may have been exposed while the feature was enabled.
- Review vendor advisory at sagedpw.at for the current supported version and remediation notes.
Validation and detection
- Inventory Sage DPW installations and identify those running 2025_06_004 or earlier self-hosted builds.
- Check whether the Database Monitor feature flag is enabled in each on-prem configuration.
- Probe known diagnostic endpoint paths from an unauthenticated network position to confirm exposure.
- Review web server, proxy, and application logs for prior access to Database Monitor URLs.
- Confirm Sage DPW Cloud tenants are excluded from scope, per vendor statement.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-67805 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N2.23.6mitreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AC:H/AV:N/A:N/C:H/I:N/PR:N/S:U/UI:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.sagedpw.at/CVE reference, mitre
- https://pastebin.com/Tk4LgMG2CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.