CVE-2023-37483 Improper Access Control Vulnerabilities in SAP PowerDesigner
An unauthenticated attacker can execute arbitrary database queries via the proxy, potentially reading or modifying backend data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-37483?
CVE-2023-37483 is a critical missing authorization vulnerability in SAP_SE SAP PowerDesigner, published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy.
Weakness: CWE-306
Which versions are affected by CVE-2023-37483?
It affects 1 product.
Products include Sap Powerdesigner.
How do I fix CVE-2023-37483?
No fix has been published for CVE-2023-37483 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-37483 being exploited?
There is no known exploitation of CVE-2023-37483 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP PowerDesigner
- CVE-2023-36923 Code Injection vulnerability in SAP PowerDesigner
- CVE-2023-40310 Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import
- CVE-2023-40621 Code Injection vulnerability in SAP PowerDesigner Client
- CVE-2023-37484 Information Disclosure Vulnerabilities in SAP PowerDesigner
Sources
Also known as GHSA-m56h-qqgf-xqhv.