Lucene search

CERT-PLCVELIST:CVE-2023-4537

HistoryFeb 15, 2024 - 8:27 a.m.

CVE-2023-4537 Protocol Downgrade in Comarch ERP XL

2024-02-1508:27:07

CWE-311

CERT-PL

www.cve.org

comarch erp xl

protocol downgrade

ms sql

data interception

data modification

vulnerability

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.

This issue affects ERP XL: from 2020.2.2 through 2023.2.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ERP XL",
    "vendor": "Comarch",
    "versions": [
      {
        "lessThanOrEqual": "2023.2",
        "status": "affected",
        "version": "2020.2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/02/CVE-2023-4537/

cert.pl/posts/2023/02/CVE-2023-4537/

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2023-4537