PT-2024-33792 · Microsoft · Mssql

Published 2024-12-18 · Updated 2025-10-03 · CVE-2024-4995

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Wapro ERP Desktop versions prior to 9.00.0

Description: The issue affects Wapro ERP Desktop, where it is vulnerable to MS SQL protocol downgrade requests from the server side. This could lead to unencrypted communication, making it vulnerable to data interception and modification.

Recommendations: For versions prior to 9.00.0, update to version 9.00.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of MS SQL protocol to minimize the risk of exploitation.

Fix

Missing Encryption of Sensitive Data

Insecure Storage of Sensitive Information

Weakness Enumeration

CWE-757

CWE-311

CWE-922

Related Identifiers

CVE-2024-4995

Affected Products

Mssql

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-4995 · Security Note
• https://t.me/cvenotify/104741 · Telegram Post
• https://wapro.pl · Note
• https://t.me/cvedetector/13198 · Telegram Post
• https://cert.pl/en/posts/2024/12/CVE-2024-4995 · Note
• https://t.me/cvenotify/104681 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1869414471052988621 · Twitter Post
• https://twitter.com/0dayPublishing/status/1974038996004020513 · Twitter Post
• https://cert.pl/posts/2024/12/CVE-2024-4995 · Note
• https://twitter.com/CVEnew/status/1869349569525432636 · Twitter Post
• https://twitter.com/CveFindCom/status/1869352592972669008 · Twitter Post
• https://t.me/cveNotify/137291 · Telegram Post