CVE-2023-37484 Information Disclosure Vulnerabilities in SAP PowerDesigner
An attacker can access password hashes from client memory due to insecure comparison logic during login in SAP PowerDesigner.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-37484?
CVE-2023-37484 is a medium-severity vulnerability in SAP_SE SAP PowerDesigner, published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.
Weakness: CWE-327
Which versions are affected by CVE-2023-37484?
It affects 1 product.
Products include Sap Powerdesigner.
How do I fix CVE-2023-37484?
No fix has been published for CVE-2023-37484 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-37484 being exploited?
There is no known exploitation of CVE-2023-37484 in the wild and no public exploit code.
Other vulnerabilities in SAP_SE SAP PowerDesigner
- CVE-2023-37483 Improper Access Control Vulnerabilities in SAP PowerDesigner
- CVE-2023-36923 Code Injection vulnerability in SAP PowerDesigner
- CVE-2023-40310 Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import
- CVE-2023-40621 Code Injection vulnerability in SAP PowerDesigner Client
Sources
Also known as GHSA-r8qv-5mc6-cp4c.