Vulnerability · Published Dec 18, 2024 · Assigned by CERT-PL
CVE-2024-4995Protocol Downgrade in Wapro ERP Desktop
Critical 9.8
In plain English
A critical-severity security flaw in Wapro ERP Desktop from Asseco Business Solutions S.A.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.9%top 39.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Asseco Business Solutions S.A. | Wapro ERP Desktop | 0 – before 9.00.0 |
Weakness: CWE-757, CWE-922 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://cert.pl/en/posts/2024/12/CVE-2024-4995/ third-party-advisory
- https://cert.pl/posts/2024/12/CVE-2024-4995/ third-party-advisory
- https://wapro.pl/ product