Security News > 2021 > July > You've patched that critical Sage X3 ERP security hole, yeah? Not exposing the suite to the internet, either, yeah?

You've patched that critical Sage X3 ERP security hole, yeah? Not exposing the suite to the internet, either, yeah?
2021-07-07 23:56

Admins of on-premises Sage X3 ERP deployments should check they're not exposing the enterprise resource planning suite to the public internet in case they fall victim to an unauthenticated command execution vulnerability.

The infosec outfit described in detail the flaws, calling them "Protocol-related issues involving remote administration of Sage X3.".

We're told CVE-2020-7388 can be exploited to trick Sage X3 into executing as NT AUTHORITY/SYSTEM commands in specially crafted requests sent to an administrative service exposed through TCP port 1818.

A successful exploit of 7390 "Could allow a regular user of Sage X3 to execute privileged functions as a currently logged-in administrator or capture administrator session cookies for later impersonation as a currently-logged-in administrator," said Rapid7.

As for the Sage X3 flaws, while the impact of the most severe one is at the highest end of the scale, normal security practices should mitigate it already, according to Rapid7.

"Generally speaking, Sage X3 installations should not be exposed directly to the internet, and should instead be made available via a secure VPN connection where required," it advised.


News URL

https://go.theregister.com/feed/www.theregister.com/2021/07/07/sage_x3_rce/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2021-07-22 CVE-2020-7388 Authentication Bypass by Spoofing vulnerability in Sage Adxadmin
Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component.
network
low complexity
sage CWE-290
7.5

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Sage 11 1 11 8 5 25