CVE-2020-7390: fallo de gravedad media en Sage X3
Sage X3 Syracuse Persistent XSS in Edit User page
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.6epss 0.6%
Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Productos afectados
Sage · X3CVEs relacionadas — Sage X3
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-7388CRITICALSage X3 AdxAdmin Unauthenticated Command Execution Bypass by SpoofingEPSS 69.4%CVE-2020-7387MEDIUMSage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized ActorEPSS 34.3%CVE-2020-7389MEDIUMSage X3 Syracuse Missing Authentication for Critical Function in Developer EnvironmentEPSS 2.1%