CVE-2023-31868
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). The application dynamically builds web page parts using user inputs without proper verification or filtering, allowing injection of malicious HTML/JavaScript code. This code is saved and executed in the victim's browser.
Risk Assessment
The risk for the organization includes potential session hijacking of an administrator, account takeover, or unauthorized actions within the system. Although the main attack vector requires an authenticated regular user, they can target an administrator, increasing potential damage.
Recommendation
Immediately update Sage X3 to the latest available version containing security fixes. Additionally, implement input filtering and validation for all user inputs and apply HTML output encoding.
Original NVD description (English source)
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is injected into those fields, this code will be saved by the application and executed by the web browser of the user viewing the web page. Several injection points have been identified on the application. The major one requires the user to be authenticated with a common account, he can then target an Administrator. All others endpoints need the malicious user to be authenticated as an Administrator. Therefore, the impact is diminished.