Read the docs
TI-2020-05972 Aliases CVE-2020-7390GHSA-w447-836c-qj8m

Sage X3 Syracuse Persistent XSS in Edit User page

Priority LOW 25CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 (components shipped with Syracuse 12.10.0 and later) of Sage X3. Other on-premises versions of Sage X3 are unaffected or unsupported by the vendor.

Why it matters now

EPSS 0.00597 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed X3 (Sage): Syracuse 12.10.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SageX3V12 to before Syracuse 12.10.0Syracuse 12.10.0Patch availableCNA
  • X3 VendorSage Affected V12 to before Syracuse 12.10.0 Fixed in Syracuse 12.10.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:sage:syracuse:*:*:*:*:*:*:*:*12.0 to before 12.10.0VulnerableSage
cpe:2.3:a:sage:x3:12.0:*:*:*:*:*:*:*12.0Running onSage
  • cpe:2.3:a:sage:syracuse:*:*:*:*:*:*:*:* Versions 12.0 to before 12.10.0 Vulnerable ·Sage
  • cpe:2.3:a:sage:x3:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·Sage

Remediation

  • Fix · CNA X3 (Sage) Fixed in Syracuse 12.10.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7390
  2. 2026-10-03 Alias added: GHSA-w447-836c-qj8m

References

Exploit 1

Patch 1

Other 1

  • TI-2020-05971 Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences