CVE-2020-7389

PoC —

CVSS 3.1

7.2 high

EPSS

2%p80

Published

Jul 22, 2021 (Jul 22, 2021)

Modified

Jun 17, 2026

Description

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Vendors: sage
Products: syracuse
Weakness: CWE-306, CWE-78
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.1%)

In the news2 stories

Multiple Sage X3 vulnerabilities expose systems to hack

Security AffairsJul 8, 22:58 UTC · Jul 8, 2021Vulnerability CVE-2020-7388 CVE-2020-7387 CVE-2020-7389+1 CVEs

Critical Flaws Reported in Sage X3 Enterprise Management Software

The Hacker NewsJul 8, 11:26 UTC · Jul 8, 2021Vulnerability CVE-2020-7388 CVE-2020-7389 CVE-2020-7387+1 CVEs