PT-2021-12652 · Sage · Sage X3

Published 2021-07-09 · Updated 2021-08-02 · CVE-2020-7390

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Sage X3 versions prior to Version 12 (components shipped with Syracuse 12.10.0 and later)

Description: The issue allows an authenticated user to inject XSS strings into the First Name, Last Name, and Email Address fields on the 'Edit' page of the User Profile component. This can lead to stored XSS attacks. Updates are available for on-premises versions of Sage X3.

Recommendations: For versions prior to Version 12, update to Version 12 (components shipped with Syracuse 12.10.0 and later) to resolve the issue. As a temporary workaround, consider restricting access to the 'Edit' page of the User Profile component until the update is applied. Avoid using the First Name, Last Name, and Email Address fields in the affected component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-7390

Affected Products

Sage X3

References · 6

• 🔥 https://rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities · Exploit
• https://sagecity.com/gb/sage-x3-uk/f/sage-x3-uk-announcements-news-and-alerts/147993/sage-x3-latest-patches · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7390 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7390 · Vendor Advisory
• https://t.me/true_secator/1904 · Telegram Post
• https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed · Note