MEDIUM✓ PATCH🇬🇧 English

CVE-2020-7390

CVSS 4.6v3.1pub. 2021-07-22upd. 2024-11-21

Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

  • Sage Syracuse

    APP
    Sage
    12.0 – 12.10.0 (bez)

  • Sage X3

    APP
    Sage
    12.0
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
XSS
CWE
Referencje

Powiązane podatności

CVE-2020-7388CRITICAL10.0ten sam produkt

Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the clie...

CVE-2023-31867HIGH7.2ten sam produkt

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.

CVE-2023-31868MEDIUM5.4ten sam produkt

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application ar...

CVE-2020-7387MEDIUM5.3ten sam produkt

Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.ex...

CVE-2020-7389MEDIUM5.5ten sam produkt

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass ...