CVE-2020-7389: Sage X3, заобикаляне на вход и права

Описание

Оригинално описание

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Засегнати продукти

• Sage X3: V9 преди Syracuse 9.22.7.2; V11 преди Syracuse 11.25.2.6; V12 преди Syracuse 12.10.2.8

Вид слабост

• CWE-306 Липсваща автентикация за критична функционалност

История

Други уязвимости в Sage X3

• 4.6CVE-2020-7390
• 10.0CVE-2020-7388
• 5.3CVE-2020-7387

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2020-7389
• https://nvd.nist.gov/vuln/detail/CVE-2020-7389
• https://rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixed