VULNERABILITY INTELLIGENCE

CVE-2020-7389

CVSS score5.5 MEDIUM
EPSS probability2.07%
CISA KEVNot currently listed
Published2021-07-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Description

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Weakness classification

  • cve@rapid7.com: CWE-306
  • nvd@nist.gov: CWE-78

Primary references