Sage X3
6 CVEs affecting Sage X3. Latest disclosed: 2023-06-22. Critical: 1, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-7388 | Critical | 10.0 | 2021-07-22 | Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. By editing the client side authentication request, an attacker can b… |
CVE-2023-31867 | High | 7.2 | 2023-06-22 | Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. |
CVE-2020-7389 | Medium | 5.5 | 2021-07-22 | Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web app… |
CVE-2023-31868 | Medium | 5.4 | 2023-06-22 | Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, tho… |
CVE-2020-7387 | Medium | 5.3 | 2021-07-22 | Sage X3 Installation Pathname Disclosure. A specially crafted packet can elicit a response from the AdxDSrv.exe component that reveals the installation directo… |
CVE-2020-7390 | Medium | 4.6 | 2021-07-22 | Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address"… |