PT-2021-12649 · Sage · Syracuse+3

Aaron Herndon + 7 · Published 2021-07-08 · Updated 2021-08-09 · CVE-2020-7387

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Sage X3 versions prior to 9 with Syracuse 9.22.7.2 Sage X3 HR & Payroll versions prior to 9 with Syracuse 9.24.1.3 Sage X3 versions prior to 11 with Syracuse 11.25.2.6 Sage X3 versions prior to 12 with Syracuse 12.10.2.8

Description: A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directory of the product. This issue can be combined with another vulnerability to achieve full remote code execution (RCE).

Recommendations: For Sage X3 versions prior to 9 with Syracuse 9.22.7.2, update to AdxAdmin 93.2.53 or later. For Sage X3 HR & Payroll versions prior to 9 with Syracuse 9.24.1.3, update to AdxAdmin 93.2.53 or later. For Sage X3 versions prior to 11 with Syracuse 11.25.2.6, update to AdxAdmin 93.2.53 or later. For Sage X3 versions prior to 12 with Syracuse 12.10.2.8, update to AdxAdmin 93.2.53 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-7387

Affected Products

Adxadmin

Adxdsrv.Exe

Sage X3

Syracuse

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/sage/x3_adxsrv_auth_bypass_cmd_exec.rb · Exploit
• 🔥 https://rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2020-7387 · Vendor Advisory
• https://sagecity.com/gb/sage-x3-uk/f/sage-x3-uk-announcements-news-and-alerts/147993/sage-x3-latest-patches · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7387 · Security Note
• https://t.me/true_secator/1904 · Telegram Post
• https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed · Note
• https://t.me/cybersecuritytechnologies/3794 · Telegram Post