CVE-2020-7390

CVE-2020-7390 describes a stored cross-site scripting (XSS) vulnerability in Sage X3, specifically affecting the 'Edit' page of user profiles in on-premises versions 12.10.0 and later of Sage Syracuse. An authenticated user can inject malicious scripts into the First Name, Last Name, and Email Address fields. This vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion and media coverage, including a Threatpost article that misleadingly suggests RCE, despite the actual vulnerability being XSS.