Lucene search

CERT-PLCVELIST:CVE-2023-4539

HistoryFeb 15, 2024 - 8:32 a.m.

CVE-2023-4539 Hardcoded password in Comarch ERP XL

2024-02-1508:32:53

CWE-798

CERT-PL

www.cve.org

cve-2023-4539

hardcoded password

comarch erp xl

database account

sensitive data

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Comarch ERP XL installations.

This issue affects ERP XL: from 2020.2.2 through 2023.2.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "ERP XL",
    "vendor": "Comarch",
    "versions": [
      {
        "lessThanOrEqual": "2023.2",
        "status": "affected",
        "version": "2020.2.2",
        "versionType": "custom"
      }
    ]
  }
]

References

cert.pl/en/posts/2024/02/CVE-2023-4537/

cert.pl/posts/2024/02/CVE-2023-4537/

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.0004 Low

EPSS

Percentile

9.0%

JSON

Related for CVELIST:CVE-2023-4539