Medium severity5.5NVD Advisory· Published Jul 22, 2021· Updated Jun 17, 2026

CVE-2020-7389

Description

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production.

Affected products

Sage/Syracuse
cpe:2.3:a:sage:syracuse:*:*:*:*:*:*:*:*
Range: >=9.0,<9.22.7.2
Sage/X3llm-create
Sage/Sagellm-fuzzy
Sage/X3v5
Range: V9

Patches

Vulnerability mechanics

References

www.rapid7.com/blog/post/2021/07/07/cve-2020-7387-7390-multiple-sage-x3-vulnerabilities/nvdExploitThird Party Advisory
rapid7.com/blog/post/2021/07/07/sage-x3-multiple-vulnerabilities-fixednvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000