CVE-2020-7389 Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment
Authenticated developers can execute OS commands via a script variable in Sage X3, requiring removal of developer environments from production.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7389?
CVE-2020-7389 is a medium-severity command injection vulnerability in Sage X3, published on 22 Jul 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.
Which versions are affected by CVE-2020-7389?
It affects 1 product.
Products include Sage Syracuse.
How do I fix CVE-2020-7389?
No fix has been published for CVE-2020-7389 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7389 being exploited?
There is no known exploitation of CVE-2020-7389 in the wild and no public exploit code.
Other vulnerabilities in Sage X3
Sources
Also known as GHSA-639w-2r2j-2x43.