Lucene search

CERT-PLCVELIST:CVE-2023-4538

HistoryFeb 15, 2024 - 8:32 a.m.

CVE-2023-4538 Shared Key in Comarch ERP XL

2024-02-1508:32:44

CWE-522

CERT-PL

www.cve.org

cve-2023-4538

shared key

database access

encryption

plain text passwords

erp xl 2020.2.2 - 2023.2

6.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords.

This issue affects ERP XL: from 2020.2.2 through 2023.2.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ERP XL",
    "vendor": "Comarch",
    "versions": [
      {
        "lessThanOrEqual": "2023.2",
        "status": "affected",
        "version": "2020.2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/02/CVE-2023-4537/

cert.pl/posts/2024/02/CVE-2023-4537/

6.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2023-4538