CVE-2020-7389: Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment
Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7389?
CVE-2020-7389 is a vulnerability in the Sage X3 System that allows an authenticated user with developer access to execute OS commands via a script command injection.
Who is affected by CVE-2020-7389?
The Sage X3 System versions 9.0 to 9.22.7.2, 11.0 to 11.25.2.6, and 12.0 to 12.10.2.8 are affected by CVE-2020-7389.
How severe is CVE-2020-7389?
CVE-2020-7389 has a severity rating of 7.2 (Critical).
How can I fix CVE-2020-7389?
To fix CVE-2020-7389, apply the necessary security patches provided by Sage.
Where can I find more information about CVE-2020-7389?
More information about CVE-2020-7389 can be found at the following references: [Reference 1](https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed) and [Reference 2](https://www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities/)