PT-2021-12650 · Sage · Syracuse+2
Published
2021-07-09
·
Updated
2021-08-09
·
CVE-2020-7388
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions:
Sage X3 versions prior to 9 (with Syracuse 9.22.7.2)
Sage X3 HR & Payroll Version 9 (with Syracuse 9.24.1.3) and earlier
Sage X3 Version 11 (with Syracuse 11.25.2.6) and earlier
Sage X3 Version 12 (with Syracuse 12.10.2.8) and earlier
Description:
The issue allows for unauthenticated remote command execution as SYSTEM in the AdxDSrv.exe component. An attacker can bypass credential validation by editing the client-side authentication request. Exploitation requires knowledge of the installation path, which can be obtained by exploiting another issue.
Recommendations:
For Sage X3 versions prior to 9, update to Version 9 with Syracuse 9.22.7.2 or later.
For Sage X3 HR & Payroll Version 9, update to Version 9 with Syracuse 9.24.1.3 or later.
For Sage X3 Version 11, update to Version 11 with Syracuse 11.25.2.6 or later.
For Sage X3 Version 12, update to Version 12 with Syracuse 12.10.2.8 or later.
As a temporary workaround, consider restricting access to the AdxDSrv.exe component until a patch is applied.
Exploit
Fix
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Adxdsrv.Exe
Sage X3
Syracuse