CVE-2020-7390

Name of the Vulnerable Software and Affected Versions: Sage X3 versions prior to Version 12 (components shipped with Syracuse 12.10.0 and later)

Description: The issue allows an authenticated user to inject XSS strings into the First Name, Last Name, and Email Address fields on the 'Edit' page of the User Profile component. This can lead to stored XSS attacks. Updates are available for on-premises versions of Sage X3.

Recommendations: For versions prior to Version 12, update to Version 12 (components shipped with Syracuse 12.10.0 and later) to resolve the issue. As a temporary workaround, consider restricting access to the 'Edit' page of the User Profile component until the update is applied. Avoid using the First Name, Last Name, and Email Address fields in the affected component until the issue is resolved.