CVE-2020-7389

Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment

State: Published
Severity: 5.5 Medium
Published: Jul 22, 2021
Updated: Sep 16, 2024
Reserved: Jan 21, 2020

Description

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	rapid7

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
X3Sage	V9 to before Syracuse 9.22.7.2Affected V11 to before Syracuse 11.25.2.6Affected V12 to before Syracuse 12.10.2.8Affected

References

https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.