VulnerabilityModified
CVE-2020-7389
Sage X3 System CHAINE Variable Script Command Injection.
HIGH 7.2EPSS 2.07%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.07%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.07% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306, CWE-78
- Affected
- sage/syracuse
- Source
- cve@rapid7.com
References
- https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixedBroken Link
- https://www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities/Exploit, Third Party Advisory
- https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixedBroken Link
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.