MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2020-7390

CVSS 4.6v3.1pub. 2021-07-22upd. 2024-11-21

Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

  • Sage Syracuse

    APP
    Sage
    12.0 – 12.10.0 (bez)

  • Sage X3

    APP
    Sage
    12.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2020-7388CRITICAL10.0ten sam produkt

Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the clie...

CVE-2023-31867HIGH7.2ten sam produkt

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.

CVE-2023-31868MEDIUM5.4ten sam produkt

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application ar...

CVE-2020-7387MEDIUM5.3ten sam produkt

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.ex...

CVE-2020-7389MEDIUM5.5ten sam produkt

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass ...