CVE-2020-7389 MEDIUM

CVE-2020-7389: Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment

Vendor Sage
Product X3
Weakness CWE-306 · Missing auth
Published July 22, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Key dates

02Disclosure timeline

July 22, 2021 CVE published
September 16, 2024 Record updated