CVE-2023-36923 Code Injection vulnerability in SAP PowerDesigner
A local attacker can execute arbitrary code by placing a malicious library, allowing them to control the application's behavior.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36923?
CVE-2023-36923 is a high-severity code injection vulnerability in SAP_SE SAP PowerDesigner, published on 8 Aug 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the application.
Weakness: CWE-94
Which versions are affected by CVE-2023-36923?
It affects 1 product.
Products include Sap Powerdesigner.
How do I fix CVE-2023-36923?
No fix has been published for CVE-2023-36923 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-36923 being exploited?
There is no known exploitation of CVE-2023-36923 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP PowerDesigner
- CVE-2023-37483 Improper Access Control Vulnerabilities in SAP PowerDesigner
- CVE-2023-40310 Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import
- CVE-2023-40621 Code Injection vulnerability in SAP PowerDesigner Client
- CVE-2023-37484 Information Disclosure Vulnerabilities in SAP PowerDesigner
Sources
Also known as GHSA-9vxj-c3q7-v3p8.