CVE-2024-4996

Hardcoded Password in Wapro ERP Desktop

CVSS 9.3 CRITICALEPSS 0.5%CWE-259 CWE-798

Use of a hard-coded password for a database administrator account created during Wapro ERP installation allows an attacker to retrieve embedded sensitive data stored in the database. The password is same among all Wapro ERP installations. This issue affects Wapro ERP Desktop versions before 8.90.0.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:I/V:C/RE:M/U:Red

Affected products

Asseco Business Solutions S.A. · Wapro ERP Desktop

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://cert.pl/en/posts/2024/12/CVE-2024-4995/https://cert.pl/posts/2024/12/CVE-2024-4995/https://wapro.pl/