Design/Logic Flaw

2024-02-1509:15:00

PRIOn knowledge base

www.prio-n.com

comarch erp xl

ms sql protocol

downgrade

unencrypted communication

vulnerability

data interception

data modification

nvd

7.7 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.0%

JSON

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.

This issue affects ERP XL: from 2020.2.2 through 2023.2.

References

cert.pl/en/posts/2024/02/CVE-2023-4537/

cert.pl/posts/2023/02/CVE-2023-4537/