CVE-2023-31867

HighCVSS 7.2

Published: 22/06/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.75%

51th percentile - higher than 51% of all known CVEs

Summary

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. An attacker can inject malicious formulas into CSV files exported from the system, potentially leading to code execution on the victim's side.

Risk Assessment

The risk involves potential compromise of the user's workstation upon opening the infected CSV file, which could result in data theft or further propagation of the attack within the organization.

Recommendation

It is recommended to update Sage X3 to the latest available version and implement input validation mechanisms before CSV export. Additionally, educate users about the risks of opening CSV files from untrusted sources.

Other vulnerabilities in Sage X3

CVE-2023-31868Medium
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). The application dynamically builds web page parts using user inputs without proper verification or filtering, allowing injection of malicious HTML/JavaScript code. This code is saved and executed in the victim's browser.

Original NVD description (English source)

Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS