PT-2025-12569
CVE-2024-8773
·
Published
2025-03-24
·
Updated
2025-03-27
Description by
CVSS 4.0
8.3
HighMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
SIMPLE.ERP versions 6.20 through 6.30 (excluding 6.30 with patch 6.30@a03.9)
Description
The issue affects the SIMPLE.ERP client, making it vulnerable to MS SQL protocol downgrade requests from the server side. This could lead to unencrypted communication, which is vulnerable to data interception and modification.
Recommendations
For versions 6.20 and 6.25, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
For version 6.30, apply patch 6.30@a03.9 to enable the administrator to enforce encrypted communication.
Found an issue in the description? Have something to add? Feel free to write us 👾