← CVE Intelligence

CVE-2020-7389

Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment PUBLISHED

Description (CNA)

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Affected (CNA)

Vendor / productVersions
Sage / X3affected V9 before Syracuse 9.22.7.2; affected V11 before Syracuse 11.25.2.6; affected V12 before Syracuse 12.10.2.8

CWE

CWE-306

References

ADP enrichment

CVE

No English description supplied.