Vulnerability Description
Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sage | Syracuse | >= 9.0, < 9.22.7.2 |
| Sage | X3 | 9.0 |
Related Weaknesses (CWE)
References
- https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixedBroken Link
- https://www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-ExploitThird Party Advisory
- https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixedBroken Link
FAQ
What is CVE-2020-7389?
CVE-2020-7389 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configurat...
How severe is CVE-2020-7389?
CVE-2020-7389 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7389?
Check the references section above for vendor advisories and patch information. Affected products include: Sage Syracuse, Sage X3.