Read the docs

Comarch

Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Comarch records in CISA KEV

No Comarch vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Erp Xl 3 records LOW

Records

3 records in Erp Xl · all components

TI-2023-04183 CVE-2023-4537 · GHSA-58qw-vfcj-x2hg

Protocol Downgrade in Comarch ERP XL

Priority LOW 35

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00611 Published 2024-02-15 No fix listed CWE-755
TI-2023-04185 CVE-2023-4539 · GHSA-p74r-mvhv-7jx7

Hardcoded password in Comarch ERP XL

Priority LOW 33

Use of a hard-coded password for a special database account created during Comarch ERP XL installation allows an attacker to retrieve embedded sensitive data stored in the database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00515 Published 2024-02-15 No fix listed CWE-798
TI-2023-04184 CVE-2023-4538 · GHSA-4g2f-j53w-6jfc

Shared Key in Comarch ERP XL

Priority LOW 29

The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00362 Published 2024-02-15 No fix listed CWE-522
Open these records in search →