CVE-2020-7388

Name of the Vulnerable Software and Affected Versions: Sage X3 versions prior to 9 (with Syracuse 9.22.7.2) Sage X3 HR & Payroll Version 9 (with Syracuse 9.24.1.3) and earlier Sage X3 Version 11 (with Syracuse 11.25.2.6) and earlier Sage X3 Version 12 (with Syracuse 12.10.2.8) and earlier

Description: The issue allows for unauthenticated remote command execution as SYSTEM in the AdxDSrv.exe component. An attacker can bypass credential validation by editing the client-side authentication request. Exploitation requires knowledge of the installation path, which can be obtained by exploiting another issue.

Recommendations: For Sage X3 versions prior to 9, update to Version 9 with Syracuse 9.22.7.2 or later. For Sage X3 HR & Payroll Version 9, update to Version 9 with Syracuse 9.24.1.3 or later. For Sage X3 Version 11, update to Version 11 with Syracuse 11.25.2.6 or later. For Sage X3 Version 12, update to Version 12 with Syracuse 12.10.2.8 or later. As a temporary workaround, consider restricting access to the AdxDSrv.exe component until a patch is applied.