PT-2024-13241 · Comarch · Comarch Erp Xl

Marcin Ochab · Published 2024-02-15 · Updated 2025-12-23 · CVE-2023-4537

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Comarch ERP XL versions 2020.2.2 through 2023.2

Description The Comarch ERP XL client is vulnerable to an MS SQL protocol downgrade request from the server side, which could lead to unencrypted communication. This makes the communication vulnerable to data interception and modification.

Recommendations For versions 2020.2.2 through 2023.2, consider updating to a version that is not affected by this issue, as the current version may allow for unencrypted communication due to the MS SQL protocol downgrade request vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2023-4537

Affected Products

Comarch Erp Xl

References · 14

• https://osv.dev/vulnerability/CVE-2023-4537 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-4537 · Security Note
• https://cert.pl/posts/2023/02/CVE-2023-4537 · Note
• https://t.me/cvenotify/71500 · Telegram Post
• https://t.me/cvenotify/71551 · Telegram Post
• https://cert.pl/posts/2024/02/CVE-2023-4537 · Note
• https://cert.pl/en/posts/2024/02/CVE-2023-4537 · Note
• https://t.me/cvenotify/71552 · Telegram Post
• https://t.me/cveNotify/146675 · Telegram Post
• https://t.me/cvenotify/71501 · Telegram Post
• https://twitter.com/RedPacketSec/status/1758794486384112005 · Twitter Post
• https://twitter.com/cracbot/status/1758370674799006084 · Twitter Post
• https://t.me/cvenotify/71550 · Telegram Post
• https://t.me/cvenotify/71499 · Telegram Post