CVE-2020-7390

Sage X3 Syracuse on-premises version 12 (components shipped with Syracuse 12.10.0 and later) is affected by CVE-2020-7390, a Stored XSS on the Edit User Profile page. An authenticated user can inject XSS strings via the First Name, Last Name, or Email Address fields. Remediation: updates are avai...

CVE-2020-7389

Sage X3 CVE-2020-7389 is a Command Injection vulnerability in the CHAINE Variable Script path. An authenticated user with developer access can pass OS commands through this variable used by the web application; this developer configuration should not be deployed in production. The connected sourc...