CVE-2020-7389
Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment
Severity Score
7.2
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
Una Inyección de Comandos de la Variable CHAINE del Sistema en Sage X3. Un usuario autenticado con acceso de desarrollador puede pasar comandos del sistema operativo por medio de esta variable usada por la aplicación web. Tenga en cuenta que esta configuración para desarrolladores no debe desplegarse en producción
*Credits:
Jonathan Peterson, Aaron Herndon, Cale Black, Ryan Villarrea, and William Vu, all of Rapid7
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-01-21 CVE Reserved
- 2021-07-22 CVE Published
- 2022-07-15 First Exploit
- 2024-09-16 CVE Updated
- 2024-12-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-306: Missing Authentication for Critical Function
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed | Broken Link |
| URL | Date | SRC |
|---|---|---|
| https://www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities | 2022-07-15 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Sage Search vendor "Sage" | Syracuse Search vendor "Sage" for product "Syracuse" | >= 9.0 < 9.22.7.2 Search vendor "Sage" for product "Syracuse" and version " >= 9.0 < 9.22.7.2" | - |
Affected
| in | Sage Search vendor "Sage" | X3 Search vendor "Sage" for product "X3" | 9.0 Search vendor "Sage" for product "X3" and version "9.0" | - |
Safe
|
| Sage Search vendor "Sage" | Syracuse Search vendor "Sage" for product "Syracuse" | >= 11.0 < 11.25.2.6 Search vendor "Sage" for product "Syracuse" and version " >= 11.0 < 11.25.2.6" | - |
Affected
| in | Sage Search vendor "Sage" | X3 Search vendor "Sage" for product "X3" | 11.0 Search vendor "Sage" for product "X3" and version "11.0" | - |
Safe
|
| Sage Search vendor "Sage" | Syracuse Search vendor "Sage" for product "Syracuse" | >= 12.0 < 12.10.2.8 Search vendor "Sage" for product "Syracuse" and version " >= 12.0 < 12.10.2.8" | - |
Affected
| in | Sage Search vendor "Sage" | X3 Search vendor "Sage" for product "X3" | 12.0 Search vendor "Sage" for product "X3" and version "12.0" | - |
Safe
|