Cyber Resilience

CVE-2023-4537

High

Published: 15 February 2024

Published
15 February 2024
Modified
23 December 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0011 29.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-4537 is a high-severity Improper Handling of Exceptional Conditions (CWE-755) vulnerability in Comarch Erp Xl. Its CVSS base score is 7.4 (High).

Operationally, ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects ERP XL: from 2020.2.2 through 2023.2.

CWE(s)
CWE-755

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

comarch
erp xl
2020.2.2 — 2023.2

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-5 Response to Audit Logging Process Failures
addresses: CWE-755

Provides defined handling (alert and additional actions) for the exceptional condition of audit logging failure.

CP-12 Safe Mode
addresses: CWE-755

Supplies a concrete handling action (safe mode) for exceptional conditions, mitigating risks from improper or absent handling that could allow continued attacks.

CP-3 Contingency Training
addresses: CWE-755

By preparing users for contingency scenarios, the control promotes proper handling of exceptional conditions instead of default or unsafe behaviors.

CP-5 Contingency Plan Update
addresses: CWE-755

An updated contingency plan defines current actions for exceptional conditions, reducing the window for attackers to exploit improper handling leading to system failure.

IR-1 Policy and Procedures
addresses: CWE-755

Procedures ensure proper handling of exceptional conditions to support effective incident response.

IR-3 Incident Response Testing
addresses: CWE-755

Incident response testing confirms proper handling of exceptional conditions to limit exploit impact.

IR-7 Incident Response Assistance
addresses: CWE-755

Gives users guidance on incident handling, reducing improper handling of exceptional conditions that could stem from exploited weaknesses.

SC-24 Fail in Known State
addresses: CWE-755

Enforces structured response to exceptional conditions so the system cannot remain in an unsafe state.

References