CVE-2023-4537 - Protocol Downgrade in Comarch ERP XL

Back Back to CVE browser

HIGH

Protocol Downgrade in Comarch ERP XL

Published Feb 15, 2024

7.4

HIGH

CVSS 3.1

EPSS 0.61%

Description

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.

This issue affects ERP XL: from 2020.2.2 through 2023.2.

Affected products

Vendor Comarch Product Erp XL Default
unaffected
- Version
  2020.2.2
  Status
  affected
  Constraints
  <=2023.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Comarch

Erp XL

unaffected

Version	Status	Constraints
2020.2.2	affected	<=2023.2

Vendor Comarch Product Erp XL Default
n/a
- Version
  2020.2.2
  Status
  affected
  Constraints
  <=2023.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Comarch

Erp XL

n/a

Version	Status	Constraints
2020.2.2	affected	<=2023.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-755

References (4)

https://cert.pl/en/posts/2024/02/CVE-2023-4537/
third-party-advisoryThird Party Advisory
https://cert.pl/posts/2023/02/CVE-2023-4537/
Broken Link
https://cert.pl/posts/2024/02/CVE-2023-4537/
third-party-advisoryThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54392
Advisory

Link	Providers	Tags
https://cert.pl/en/posts/2024/02/CVE-2023-4537/		third-party-advisoryThird Party Advisory
https://cert.pl/posts/2023/02/CVE-2023-4537/		Broken Link
https://cert.pl/posts/2024/02/CVE-2023-4537/		third-party-advisoryThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54392		Advisory