CVE-2023-4538

Published: Feb 15, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The database access credentials configured during installation are stored in a special table, and are encrypted with a shared key, same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords. This issue affects ERP XL: from 2020.2.2 through 2023.2.

Affected (1)

Products: Comarch: Erp Xl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Comarch Erp Xl	From 2020.2.2 to 2023.2

Related CWEs

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (4)

https://cert.pl/en/posts/2024/02/CVE-2023-4537/

Source: cvd@cert.pl

Third Party Advisory

https://cert.pl/posts/2024/02/CVE-2023-4537/

Source: cvd@cert.pl

Third Party Advisory

https://cert.pl/en/posts/2024/02/CVE-2023-4537/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://cert.pl/posts/2024/02/CVE-2023-4537/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.