CVE-2023-4538

Name of the Vulnerable Software and Affected Versions Comarch ERP XL versions 2020.2.2 through 2023.2

Description The database access credentials configured during installation are stored in a special table and are encrypted with a shared key that is the same among all Comarch ERP XL client installations. This could allow an attacker with access to that table to retrieve plain text passwords.

Recommendations For versions 2020.2.2 through 2023.2, consider changing the database access credentials and the shared encryption key to prevent unauthorized access. As a temporary workaround, restrict access to the special table that stores the database access credentials to minimize the risk of exploitation.