CVE-2020-7389: Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web…

PriorityP345high7.2CVSS 3.1

AVNACLPRHUINSUCHIHAH

EPSS

2.07%

79.1th percentile

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sage	syracuse	>= 11.0 < 11.25.2.6	11.25.2.6
sage	syracuse	>= 12.0 < 12.10.2.8	12.10.2.8
sage	syracuse	>= 9.0 < 9.22.7.2	9.22.7.2
sage	x3	>= V11 < Syracuse 11.25.2.6	Syracuse 11.25.2.6
sage	x3	>= V12 < Syracuse 12.10.2.8	Syracuse 12.10.2.8
sage	x3	>= V9 < Syracuse 9.22.7.2	Syracuse 9.22.7.2

CVSS provenance

nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.